Cloudanix VulnDB

CVE-2023-54086

None

CVSS

—

EPSS

0.2%

Published

Dec 24, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can let certain monitoring tools cause the entire system to crash.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper recursion protection in BPF program enter/exit paths leaves preempt_count_sub and preempt_count_add unprotected, allowing trampoline attachment to trigger uncontrolled recursion that overwrites stack guard pages and causes kernel panic.

Why it matters to the business

Linux systems running affected kernels can experience sudden crashes and reboots when BPF tracing or monitoring tools attach to the vulnerable functions, disrupting services and requiring manual recovery.

How an attack unfolds

An attacker with the ability to load BPF programs compiles and attaches a trampoline to preempt_count_sub or preempt_count_add; the missing deny-list entry allows the recursion check to be bypassed after prog->active is decremented, immediately triggering repeated calls that exhaust the stack and hit the guard page, producing a kernel panic.

How to fix it

Upgrade the Linux kernel to a commit that adds preempt_count_sub and preempt_count_add to the BTF ID deny list; the fix is present in commit 095018267c87b8bfbbb12eeb1c0ebf2359e1782c and commit 182e5ddaa51972e144005b500c4bcebf2fd1a6c0. Reboot after installing the updated kernel package.

How to confirm the fix worked

Confirm the running kernel contains the deny-list entries for preempt_count_sub and preempt_count_add by inspecting /sys/kernel/btf or verifying the kernel build includes the referenced commits; attempt to attach a test trampoline to the functions and ensure attachment is rejected without panic.

Typical attack path

  1. Obtain capability to load unprivileged or privileged BPF programs on target kernel
  2. Craft a BPF program that installs a trampoline on preempt_count_sub or preempt_count_add
  3. Load and attach the program, causing __bpf_prog_exit_recur to invoke the unprotected functions
  4. Observe repeated recursion until stack guard page is hit and kernel panics

How to detect it

Search kernel logs and crash dumps for BUG messages referencing TASK or IRQ stack guard page hits immediately followed by calls to preempt_count_sub or __bpf_prog_enter_recur / __bpf_prog_exit_recur; correlate with bpf_trampoline symbols in the stack trace.

  • BUG: TASK stack guard page was hit
  • BUG: IRQ stack guard page was hit
  • preempt_count_sub+0x1/0xa0
  • __bpf_prog_enter_recur
  • __bpf_prog_exit_recur
  • bpf_trampoline

What your security team should do

  • Prioritize kernel upgrade on all systems that permit BPF program loading
  • Restrict unprivileged BPF loading via kernel.unprivileged_bpf_disabled sysctl until patched
  • Monitor for kernel panics containing stack-guard-page messages involving preempt_count_sub

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Add preempt_count_{sub,add} into btf id deny list The recursion check in __bpf_prog_enter* and __bpf_prog_exit* leave preempt_count_{sub,add} unprotected. When attaching trampoline to them we get panic as follows, [ 867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is 0000000046a46a15..00000000537e7b28) [ 867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI [ 867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4 [ 867.843100] Call Trace: [ 867.843101] <TASK> [ 867.843104] asm_exc_int3+0x3a/0x40 [ 867.843108] RIP: 0010:preempt_count_sub+0x1/0xa0 [ 867.843135] __bpf_prog_enter_recur+0x17/0x90 [ 867.843148] bpf_trampoline_6442468108_0+0x2e/0x1000 [ 867.843154] ? preempt_count_sub+0x1/0xa0 [ 867.843157] preempt_count_sub+0x5/0xa0 [ 867.843159] ? migrate_enable+0xac/0xf0 [ 867.843164] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843168] bpf_trampoline_6442468108_0+0x55/0x1000 ... [ 867.843788] preempt_count_sub+0x5/0xa0 [ 867.843793] ? migrate_enable+0xac/0xf0 [ 867.843829] __bpf_prog_exit_recur+0x2d/0x40 [ 867.843837] BUG: IRQ stack guard page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35) [ 867.843841] BUG: IRQ stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c) [ 867.843843] BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec) [ 867.843842] bpf_trampoline_6442468108_0+0x55/0x1000 ... That is because in __bpf_prog_exit_recur, the preempt_count_{sub,add} are called after prog->active is decreased. Fixing this by adding these two functions into btf ids deny list.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 5.15.113
Linux Kernel 5.13.0 5.15.113

Related vulnerabilities