CVE-2023-54086

Vulnerability

A recursion-safety oversight in the BPF subsystem leaves the preempt_count_sub and preempt_count_add helper functions exposed to trampoline attachment. The kernel's __bpf_prog_enter_recur and __bpf_prog_exit_recur functions, which manage the per-program recursion counter, call these preemption-count helpers after the recursion guard (prog->active) has already been decremented. This ordering creates a window where a BPF trampoline attached to preempt_count_sub or preempt_count_add can be invoked during that unprotected state, leading to an infinite recursion that exhausts the kernel stack.

Exploitation

An attacker with the ability to load and attach BPF programs (i.e., having CAP_BPF or sufficient privileges) can target the preempt_count_sub or preempt_count_add functions with a trampoline. The attack does not require any user interaction beyond loading a specially crafted BPF program. By triggering the unprotected code paths in __bpf_prog_exit_recur (for example, through a BPF program that returns early or recurses), the attached trampoline will re-enter the same function, causing repeated stack guard page hits and eventually a kernel panic [1][2].

Impact

The vulnerability results in a denial of service (system crash) via a kernel panic. The crash trace shows multiple concurrent "BUG: stack guard page was hit" messages for both the task stack and IRQ stacks, indicating that the recursion can rapidly consume available kernel stack space. No privilege escalation or data leak is described in the source material.

Mitigation

The fix, introduced in Linux kernel commits [1] and [2], adds both preempt_count_sub and preempt_count_add to the BTF ID deny list, preventing BPF trampolines from being attached to these functions. Administrators should apply the updated kernel from their distribution's stable release. No workaround is available without patching, as the bug exists in the core BPF trampoline logic.