CVE-2023-54244

What it actually does

Use-after-free in the ACPI EC driver when a custom query handler is removed while its callback may still be executing inside the EC query workqueue, allowing a freed function pointer to be dereferenced after the owning module is unloaded.

Why it matters to the business

Kernel oopses or crashes can occur on Linux systems during module unload or handler removal, causing denial of service, system instability, or unexpected reboots in environments that use custom ACPI EC query handlers.

How an attack unfolds

An attacker loads a kernel module that registers a custom ACPI EC query handler, triggers EC query processing that enqueues work, then removes the handler and unloads the module before the workqueue drains, causing the work item to reference already-freed memory and panic the kernel.

How to fix it

Update the Linux kernel to a version containing commit 130e3eac51912f2c866e7d035992ede25f8feac0 which adds flushing of the EC query workqueue when custom handlers are removed; apply the fixed package versions listed for each affected Linux distribution or git tree.

How to confirm the fix worked

Confirm the fix commit is present in the running kernel source tree or verify that the kernel version is newer than the vulnerable releases; reproduce handler removal under load and ensure no oops occurs in dmesg.

Typical attack path

1. Load a kernel module that registers an ACPI EC custom query handler
2. Cause an EC query event that schedules work on the EC workqueue
3. Remove the custom handler while the work item is still queued or executing
4. Unload the module containing the handler callback
5. Trigger dereference of the freed handler leading to oops

How to detect it

Search kernel logs (dmesg, syslog, journalctl) for oops or panic messages referencing ACPI EC, query handlers, or workqueue execution after module unload events.

What your security team should do

• Prioritize kernel updates on all Linux systems that may register custom ACPI EC handlers
• Review any out-of-tree modules using ACPI EC query interfaces for safe unload patterns
• Enable kernel panic logging and monitoring to detect related oopses
• Test module load/unload sequences in staging environments before production rollout