CVE-2023-54045

What it actually does

The vulnerability allows generation of hundreds or thousands of PATH audit records in __audit_inode_child() without yielding the CPU, leading to watchdog soft lockups and potential kernel panic when tracefs or debugfs operations occur under heavy audit rules.

Why it matters to the business

Systems running affected kernels with audit enabled on filesystem events can experience sudden unresponsiveness or crashes during routine operations involving debug or trace filesystems, disrupting services and requiring manual intervention or reboot.

How an attack unfolds

An attacker or local process triggers the condition by enabling audit rules that capture open syscalls, then performing repeated or nested directory and file operations within tracefs or debugfs instances, flooding the audit path recording logic until the soft lockup threshold is reached.

How to fix it

Apply the upstream fix by updating to a kernel containing commit d061e2bfc20f2914656385816e0d20566213c54c, which inserts cond_resched() calls inside __audit_inode_child(). Rebuild and reboot with the patched kernel; consider temporarily disabling verbose audit rules on tracefs/debugfs paths as a short-term mitigation.

How to confirm the fix worked

Confirm the presence of cond_resched() inside __audit_inode_child() in the running kernel source or binary, and test by reproducing the original mkdir scenario under the documented audit configuration without observing soft lockups.

Typical attack path

1. Enable audit rules for relevant syscalls such as open or mkdir
2. Perform filesystem operations that generate large numbers of PATH records inside tracefs or debugfs
3. Sustain the workload long enough to exceed the watchdog threshold
4. Trigger soft lockup and potential kernel panic

How to detect it

Search kernel logs and dmesg for soft lockup or hung task messages that include the function __audit_inode_child or tracefs operations; correlate with audit configuration changes and mkdir activity on /sys/kernel/debug or /sys/kernel/tracing.

What your security team should do

• Prioritize patching production kernels that have audit enabled and expose tracefs or debugfs
• Review audit policies to reduce PATH record volume on debug filesystems until patches are applied
• Monitor for soft lockup messages referencing __audit_inode_child in system logs