Security readout for executives and security teams
Plain-English summary
CVE-2023-54045 is a Linux kernel audit bug that can make a CPU appear stuck while processing excessive audit PATH records from tracefs or debugfs activity. In the demonstrated case, this led to a kernel panic. The main business risk is local availability impact, not data theft or remote compromise.
Executive priority
Treat as a kernel availability issue for Linux fleets, especially systems where downtime is costly. Prioritize normal kernel patch cycles unless internal evidence shows reachable debugfs or tracefs access by less-trusted users or repeated soft lockups.
Technical view
The issue is in __audit_inode_child(), where large numbers of PATH records from tracefs/debugfs can keep the kernel from rescheduling promptly. Stable fixes add cond_resched() so long processing yields CPU time. Sources list Linux kernel versions including 3.3 through 6.6 as affected and provide multiple stable commit references.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with audit enabled and tracefs or debugfs operations available. The source example uses KASAN enabled and preemption disabled, but the record does not fully define all required conditions or privilege requirements.
Exploitation context
No active exploitation is reported in the supplied sources, and the CVE is not listed as KEV. The public description demonstrates a local sequence causing soft lockup, but this analysis does not treat that as evidence of exploitation in the wild.
Researcher notes
The source record lacks CVSS, CWE, and full prerequisite detail. It names the vulnerable function, impact pattern, affected version range, and stable commits. Avoid assuming remote reachability, privilege boundary impact, or exploit maturity without additional vendor evidence.
Mitigation direction
- Update to a Linux kernel containing the referenced stable fix commits.
- Check your Linux distribution security advisories for the exact backported kernel package.
- Restrict debugfs and tracefs access to trusted administrators where operationally feasible.
- Review audit rules that may generate excessive PATH records on sensitive systems.
Validation and detection
- Inventory kernel versions across Linux servers and appliances.
- Confirm whether vendor kernels include the audit cond_resched() fix.
- Check whether audit, tracefs, or debugfs are enabled on exposed hosts.
- Review logs for soft lockup or kernel panic messages involving __audit_inode_child().
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit d061e2bfc20f
- Linux stable commit 1640c7bd4edd
- Linux stable commit f6364fa751d7
- Linux stable commit 98ef243d5900
- Linux stable commit 0152e7758cc4
- Linux stable commit 9ca08adb75fb
- Linux stable commit 8a40b4913729
- Linux stable commit 8e76b944a7b9
- Linux stable commit b59bc6e37237
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-54045 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d061e2bfc20f2914656385816e0d20566213c54cCVE reference, Linux
- https://git.kernel.org/stable/c/1640c7bd4eddec6c72f3a99cbb74e333a2ce9f5dCVE reference, Linux
- https://git.kernel.org/stable/c/f6364fa751d7486502c777f124a14d4d543fc5ebCVE reference, Linux
- https://git.kernel.org/stable/c/98ef243d5900d75a64539a2165745bffbb155d43CVE reference, Linux
- https://git.kernel.org/stable/c/0152e7758cc4e9f8bfba8dbea4438d8e488d6c08CVE reference, Linux
- https://git.kernel.org/stable/c/9ca08adb75fb40a8f742c371927ee73f9dc753bfCVE reference, Linux
- https://git.kernel.org/stable/c/8a40b491372966ba5426e138a53460985565d5a6CVE reference, Linux
- https://git.kernel.org/stable/c/8e76b944a7b9bddef190ffe2e29c9ae342ab91edCVE reference, Linux
- https://git.kernel.org/stable/c/b59bc6e37237e37eadf50cd5de369e913f524463CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.