GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54303 (GCVE-0-2023-54303)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:23 – Updated: 2026-08-05 09:19
VLAI
Title
bpf: Disable preemption in bpf_perf_event_output
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_perf_event_output The nesting protection in bpf_perf_event_output relies on disabled preemption, which is guaranteed for kprobes and tracepoints. However bpf_perf_event_output can be also called from uprobes context through bpf_prog_run_array_sleepable function which disables migration, but keeps preemption enabled. This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perf_sample_data buffer and cause crashes like: kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle page fault for address: ffffffff82be3eea ... Call Trace: ? __die+0x1f/0x70 ? page_fault_oops+0x176/0x4d0 ? exc_page_fault+0x132/0x230 ? asm_exc_page_fault+0x22/0x30 ? perf_output_sample+0x12b/0x910 ? perf_event_output+0xd0/0x1d0 ? bpf_perf_event_output+0x162/0x1d0 ? bpf_prog_c6271286d9a4c938_krava1+0x76/0x87 ? __uprobe_perf_func+0x12b/0x540 ? uprobe_dispatcher+0x2c4/0x430 ? uprobe_notify_resume+0x2da/0xce0 ? atomic_notifier_call_chain+0x7b/0x110 ? exit_to_user_mode_prepare+0x13e/0x290 ? irqentry_exit_to_user_mode+0x5/0x30 ? asm_exc_int3+0x35/0x40 Fixing this by disabling preemption in bpf_perf_event_output.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9 , < 3654ed5daf492463c3faa434c7000d45c2da2ace (git)
Affected: 8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9 , < a0ac32cf61e5a76e2429e486925a52ee41dd75e3 (git)
Affected: 8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9 , < f2c67a3e60d1071b65848efaa8c3b66c363dd025 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.45 , ≤ 6.1.* (semver)
Unaffected: 6.4.10 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3654ed5daf492463c3faa434c7000d45c2da2ace",
              "status": "affected",
              "version": "8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9",
              "versionType": "git"
            },
            {
              "lessThan": "a0ac32cf61e5a76e2429e486925a52ee41dd75e3",
              "status": "affected",
              "version": "8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9",
              "versionType": "git"
            },
            {
              "lessThan": "f2c67a3e60d1071b65848efaa8c3b66c363dd025",
              "status": "affected",
              "version": "8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.45",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable preemption in bpf_perf_event_output\n\nThe nesting protection in bpf_perf_event_output relies on disabled\npreemption, which is guaranteed for kprobes and tracepoints.\n\nHowever bpf_perf_event_output can be also called from uprobes context\nthrough bpf_prog_run_array_sleepable function which disables migration,\nbut keeps preemption enabled.\n\nThis can cause task to be preempted by another one inside the nesting\nprotection and lead eventually to two tasks using same perf_sample_data\nbuffer and cause crashes like:\n\n  kernel tried to execute NX-protected page - exploit attempt? (uid: 0)\n  BUG: unable to handle page fault for address: ffffffff82be3eea\n  ...\n  Call Trace:\n   ? __die+0x1f/0x70\n   ? page_fault_oops+0x176/0x4d0\n   ? exc_page_fault+0x132/0x230\n   ? asm_exc_page_fault+0x22/0x30\n   ? perf_output_sample+0x12b/0x910\n   ? perf_event_output+0xd0/0x1d0\n   ? bpf_perf_event_output+0x162/0x1d0\n   ? bpf_prog_c6271286d9a4c938_krava1+0x76/0x87\n   ? __uprobe_perf_func+0x12b/0x540\n   ? uprobe_dispatcher+0x2c4/0x430\n   ? uprobe_notify_resume+0x2da/0xce0\n   ? atomic_notifier_call_chain+0x7b/0x110\n   ? exit_to_user_mode_prepare+0x13e/0x290\n   ? irqentry_exit_to_user_mode+0x5/0x30\n   ? asm_exc_int3+0x35/0x40\n\nFixing this by disabling preemption in bpf_perf_event_output."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is BPF/uprobe tracing infrastructure reached only by executing code on the machine (hitting an instrumented userspace function via local process execution). There is no remote or adjacent-network entry point.\nAC:L - The attacker controls both racing sides \u2014 they run all the threads that hit the uprobe \u2014 and can pin them to a single CPU with sched_setaffinity, widen the window with large bpf_perf_event_output payloads, and rely on full preemption being the default on PREEMPT_DYNAMIC distro and Android kernels. Nothing required is outside attacker influence.\nPR:L - In the realistic worst case \u2014 a host running a system-wide uprobe/USDT observability agent (bpftrace, BCC, continuous profiler), whose programs use perf_submit()/bpf_perf_event_output by default \u2014 any unprivileged local user triggers the corruption merely by executing the instrumented binary concurrently. No capability of the attacker\u0027s own is needed.\nUI:N - The attacker\u0027s own threads hit the uprobe and generate the preemption; no victim action or interaction is required.\nS:U - The corrupted per-CPU perf_sample_data and the resulting code execution are entirely within the kernel\u0027s own security authority, with no crossing into a hypervisor, IOMMU, or other authority.\nC:H - The shared slot leaves data-\u003eraw pointing at another task\u0027s freed/reused kernel stack, so __output_copy() copies frag-\u003esize bytes from an arbitrary frag-\u003edata pointer into the mmapped perf ring buffer, yielding arbitrary kernel memory disclosure.\nI:H - __output_custom() performs an indirect call through frag-\u003ecopy read from a reused kernel stack \u2014 confirmed by the \"kernel tried to execute NX-protected page - exploit attempt?\" oops \u2014 giving an attacker-sprayable control-flow hijack primitive on top of concurrent writes to a shared perf_sample_data.\nA:H - The commit message documents a reproducible kernel page fault / oops in perf_output_sample, and the race can be re-triggered at will to repeatedly panic the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:19:03.573Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3654ed5daf492463c3faa434c7000d45c2da2ace"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0ac32cf61e5a76e2429e486925a52ee41dd75e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2c67a3e60d1071b65848efaa8c3b66c363dd025"
        }
      ],
      "title": "bpf: Disable preemption in bpf_perf_event_output",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54303",
    "datePublished": "2025-12-30T12:23:37.827Z",
    "dateReserved": "2025-12-30T12:06:44.529Z",
    "dateUpdated": "2026-08-05T09:19:03.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54303",
      "date": "2026-09-16",
      "epss": "0.00148",
      "percentile": "0.0436"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54303\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-30T13:16:19.437\",\"lastModified\":\"2026-08-04T11:16:39.610\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Disable preemption in bpf_perf_event_output\\n\\nThe nesting protection in bpf_perf_event_output relies on disabled\\npreemption, which is guaranteed for kprobes and tracepoints.\\n\\nHowever bpf_perf_event_output can be also called from uprobes context\\nthrough bpf_prog_run_array_sleepable function which disables migration,\\nbut keeps preemption enabled.\\n\\nThis can cause task to be preempted by another one inside the nesting\\nprotection and lead eventually to two tasks using same perf_sample_data\\nbuffer and cause crashes like:\\n\\n  kernel tried to execute NX-protected page - exploit attempt? (uid: 0)\\n  BUG: unable to handle page fault for address: ffffffff82be3eea\\n  ...\\n  Call Trace:\\n   ? __die+0x1f/0x70\\n   ? page_fault_oops+0x176/0x4d0\\n   ? exc_page_fault+0x132/0x230\\n   ? asm_exc_page_fault+0x22/0x30\\n   ? perf_output_sample+0x12b/0x910\\n   ? perf_event_output+0xd0/0x1d0\\n   ? bpf_perf_event_output+0x162/0x1d0\\n   ? bpf_prog_c6271286d9a4c938_krava1+0x76/0x87\\n   ? __uprobe_perf_func+0x12b/0x540\\n   ? uprobe_dispatcher+0x2c4/0x430\\n   ? uprobe_notify_resume+0x2da/0xce0\\n   ? atomic_notifier_call_chain+0x7b/0x110\\n   ? exit_to_user_mode_prepare+0x13e/0x290\\n   ? irqentry_exit_to_user_mode+0x5/0x30\\n   ? asm_exc_int3+0x35/0x40\\n\\nFixing this by disabling preemption in bpf_perf_event_output.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nbpf: Deshabilitar la preferencia en bpf_perf_event_output\\n\\nLa protecci\u00f3n de anidamiento en bpf_perf_event_output se basa en la preferencia deshabilitada, lo cual est\u00e1 garantizado para kprobes y tracepoints.\\n\\nSin embargo, bpf_perf_event_output tambi\u00e9n puede ser llamado desde el contexto de uprobes a trav\u00e9s de la funci\u00f3n bpf_prog_run_array_sleepable que deshabilita la migraci\u00f3n, pero mantiene la preferencia habilitada.\\n\\nEsto puede causar que una tarea sea preferida por otra dentro de la protecci\u00f3n de anidamiento y eventualmente llevar a que dos tareas usen el mismo b\u00fafer perf_sample_data y causen fallos como:\\n\\n  el kernel intent\u00f3 ejecutar una p\u00e1gina protegida por NX - \u00bfintento de exploit? (uid: 0)\\n  BUG: no se puede manejar el fallo de p\u00e1gina para la direcci\u00f3n: ffffffff82be3eea\\n  ...\\n  Rastro de Llamada:\\n   ? __die+0x1f/0x70\\n   ? page_fault_oops+0x176/0x4d0\\n   ? exc_page_fault+0x132/0x230\\n   ? asm_exc_page_fault+0x22/0x30\\n   ? perf_output_sample+0x12b/0x910\\n   ? perf_event_output+0xd0/0x1d0\\n   ? bpf_perf_event_output+0x162/0x1d0\\n   ? bpf_prog_c6271286d9a4c938_krava1+0x76/0x87\\n   ? __uprobe_perf_func+0x12b/0x540\\n   ? uprobe_dispatcher+0x2c4/0x430\\n   ? uprobe_notify_resume+0x2da/0xce0\\n   ? atomic_notifier_call_chain+0x7b/0x110\\n   ? exit_to_user_mode_prepare+0x13e/0x290\\n   ? irqentry_exit_to_user_mode+0x5/0x30\\n   ? asm_exc_int3+0x35/0x40\\n\\nEsto se soluciona deshabilitando la preferencia en bpf_perf_event_output.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/bpf_trace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9\",\"lessThan\":\"3654ed5daf492463c3faa434c7000d45c2da2ace\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9\",\"lessThan\":\"a0ac32cf61e5a76e2429e486925a52ee41dd75e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9\",\"lessThan\":\"f2c67a3e60d1071b65848efaa8c3b66c363dd025\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/bpf_trace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.45\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.10\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3654ed5daf492463c3faa434c7000d45c2da2ace\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a0ac32cf61e5a76e2429e486925a52ee41dd75e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f2c67a3e60d1071b65848efaa8c3b66c363dd025\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:51:35+00:00",
      "cve": "CVE-2023-54303",
      "id": "CVE-2023-54303",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Disable preemption in bpf_perf_event_output",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54303.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:14:53Z",
      "cve": "CVE-2023-54303",
      "id": "CVE-2023-54303",
      "initial_release_date": "2025-12-31T00:26:17Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "423",
      "product_status:recommended": "241",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54303",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54303.json",
      "version": "32"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.