LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54235: PCI/DOE: Fix destroy_work_on_stack() race

In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fix destroy_work_on_stack() race The following debug object splat was observed in testing: ODEBUG: free active (active state 0) object: 0000000097d23782 object type: work_struct hint: doe_statemachine_work+0x0/0x510 WARNING: CPU: 1 PID: 71 at lib/debugobjects.c:514 debug_print_object+0x7d/0xb0 ... Workqueue: pci 0000:36:00.0 DOE [1 doe_statemachine_work RIP: 0010:debug_print_object+0x7d/0xb0 ... Call Trace: ? debug_print_object+0x7d/0xb0 ? __pfx_doe_statemachine_work+0x10/0x10 debug_object_free.part.0+0x11b/0x150 doe_statemachine_work+0x45e/0x510 process_one_work+0x1d4/0x3c0 This occurs because destroy_work_on_stack() was called after signaling the completion in the calling thread. This creates a race between destroy_work_on_stack() and the task->work struct going out of scope in pci_doe(). Signal the work complete after destroying the work struct. This is safe because signal_task_complete() is the final thing the work item does and the workqueue code is careful not to access the work struct after.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-54235 is a Linux kernel PCI/DOE workqueue race where cleanup happened after completion signaling, allowing an active stack work item to be freed. The public record describes a kernel warning observed in testing, not a confirmed attacker path or business impact.

Executive priority

Treat this as a kernel maintenance item unless your environment has affected Linux kernels in sensitive or high-availability roles. Current public evidence does not justify emergency response, but kernel defects can affect platform reliability.

Technical view

The resolved bug is in PCI/DOE handling. destroy_work_on_stack() was called after task completion signaling, creating a race with the stack work_struct lifetime in pci_doe(). The fix changes ordering so completion is signaled after destroying the work struct.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions or downstream builds containing the vulnerable PCI/DOE code. The source bundle lists Linux as the affected product, but does not provide distribution package names or precise downstream status.

Exploitation context

No active exploitation is supported by the provided sources. KEV is false, and the source bundle describes a debug-object warning observed during testing rather than a public exploit or real-world incident.

Researcher notes

The record lacks CVSS, CWE, exploitability detail, and downstream package mapping. Analysis should focus on whether deployed kernels contain the affected PCI/DOE code and whether the referenced stable commits are present or backported.

Mitigation direction

  • Check the running kernel against vendor and distribution advisories.
  • Update to a kernel build containing the referenced stable fixes.
  • Prioritize systems using affected Linux kernel branches.
  • Use normal change windows if no operational exposure is identified.

Validation and detection

  • Inventory Linux kernel versions across servers, endpoints, and appliances.
  • Confirm whether vendor kernels include the PCI/DOE stable fix commits.
  • Review kernel logs for related debug-object or workqueue warnings.
  • Track distro advisories because downstream backports may change version labels.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54235 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2a0e0f4773fe8032fb17e56f897bee32ce3cdc2b, abf04be0e7071f2bcd39bf97ba407e7d4439785e, abf04be0e7071f2bcd39bf97ba407e7d4439785e, abf04be0e7071f2bcd39bf97ba407e7d4439785e, 95628b830952943631d3d74f73f431f501c5d6f5, 6.1.24, 6.2.11unaffected
LinuxLinux6.3, 0, 6.1.53, 6.4.16, 6.5.3, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.