CVE-2023-54268

Root

Cause

The vulnerability resides in the debugobjects subsystem's fill_pool() function, which allocates memory using GFP_ATOMIC. This flag includes __GFP_KSWAPD_RECLAIM, causing the allocation to attempt to wake up kswapd, which acquires the kswapd_wait::lock. Since fill_pool() can be invoked while holding arbitrary locks, this can lead to a lockdep warning and potential deadlock.

Exploitation

Exploitation requires no special privileges; an attacker could trigger the code path that calls fill_pool() while holding a lock that conflicts with kswapd_wait::lock. This is likely reachable from user space via certain operations that cause debug object tracking. The syzbot fuzzer discovered this issue, indicating it can be triggered remotely or locally.

Impact

The impact is a system lockup or denial of service due to a deadlock or lockdep splat. While not directly exploitable for code execution, it can cause system instability.

Mitigation

The fix replaces GFP_ATOMIC with __GFP_HIGH and removes the unnecessary __GFP_NORETRY flag. The patch has been applied to stable kernel branches as seen in commits [1][2][3]. Users should update to the latest stable kernel.