CVE-2023-53790

Vulnerability

In the Linux kernel, the BPF memory allocator for hash maps (htab) reuses freed slab objects without zeroing them. When an element is freed and then immediately reused, the allocator leaves stale data, including special fields like bpf_spin_lock, in an inconsistent state. The lookup operation (copy_map_value_locked) may then access these corrupted spinlocks, causing a system-wide hard lockup. [1]

Exploitation

An authenticated local user able to create and manipulate BPF hash maps can trigger the condition. The race occurs on concurrent map accesses—a lookup_elem executing while the same element is being reused from the slab cache—without proper synchronization. No new capabilities or network access are required; the prerequisite is only CAP_BPF or permissions to use bpf system calls.

Impact

A successful exploitation leads to a denial of service (DoS) via an unrecoverable kernel lockup (NMI backtrace shown in the report). The flaw does not provide arbitrary code execution or privilege escalation, but the hard lockup can crash the entire system. Affected kernels include versions from the introduction of the BPF slab allocator until the fix was merged in stable updates. [2]

Mitigation

The fix initializes reused slab objects with __GFP_ZERO in the non-preallocated htab path, matching the behavior of the preallocated allocator. Per-CPU allocators already zero memory implicitly. The patch has been backported to stable kernel releases as shown in the referenced commits [1][2]. Users should update to the latest kernel containing this fix. No workaround short of disabling BPF is available.