CVE-2023-54267

What it actually does

lppaca_shared_proc() pointer usage triggers spurious DEBUG_PREEMPT checks via smp_processor_id() when lparcfg procfs is read on powerpc, producing BUG messages without actual preemption violation.

Why it matters to the business

Interrupts kernel debugging and testing workflows on affected powerpc platforms, generates noise in logs, and may delay stable releases or expose systems running debug kernels to unnecessary operational friction.

How an attack unfolds

An attacker or tester simply reads /proc/powerpc/lparcfg on a DEBUG_PREEMPT-enabled powerpc kernel; the call path through lparcfg_data invokes the flawed helper and hits the preemption check, surfacing the BUG without further attacker actions required.

How to fix it

Upgrade Linux kernel to a version containing commit 953c54dfdc5d3eb7243ed902b50acb5ea1db4355 or later; rebuild with the reworked lppaca_shared_proc() that directly accesses the lppaca without taking a pointer.

How to confirm the fix worked

Confirm kernel source contains the commit or version string, then exercise /proc/powerpc/lparcfg access under DEBUG_PREEMPT and verify absence of the preemption BUG message.

Typical attack path

1. Obtain local shell or user context on powerpc Linux system
2. Ensure kernel built with DEBUG_PREEMPT
3. Read /proc/powerpc/lparcfg via cat or similar
4. Observe kernel BUG trace referencing check_preemption_disabled and lparcfg_data

How to detect it

Search kernel logs and dmesg for the exact BUG string mentioning smp_processor_id in preemptible code together with lparcfg_data caller; correlate with powerpc architecture and recent lparcfg access.

• BUG: using smp_processor_id() in preemptible
• caller is lparcfg_data
• lppaca_shared_proc

What your security team should do

• Prioritize kernel update on all powerpc systems using DEBUG_PREEMPT builds
• Monitor changelogs for stable trees containing 953c54dfdc5d3eb7243ed902b50acb5ea1db4355
• Temporarily avoid DEBUG_PREEMPT on production powerpc kernels until patched