In the Linux kernel, the following vulnerability has been resolved:

kheaders: Use array declaration instead of char

Under CONFIG_FORTIFY_SOURCE, memcpy() will check the size of destination
and source buffers. Defining kernel_headers_data as "char" would trip
this check. Since these addresses are treated as byte arrays, define
them as arrays (as done everywhere else).

This was seen with:

$ cat /sys/kernel/kheaders.tar.xz >> /dev/null

detected buffer overflow in memcpy
kernel BUG at lib/string_helpers.c:1027!
...
RIP: 0010:fortify_panic+0xf/0x20
[...]
Call Trace:
<TASK>
ikheaders_read+0x45/0x50 [kheaders]
kernfs_fop_read_iter+0x1a4/0x2f0
...

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00045.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
43d8ce9d65a54846d378545770991e65838981e0 affected < 719459877d58c8aced5845c1e5b98d8d87d09197
43d8ce9d65a54846d378545770991e65838981e0 affected < fcd2da2e6bf2640a31a2a5b118b50dc3635c707b
43d8ce9d65a54846d378545770991e65838981e0 affected < 4a07d2d511e2703efd4387891d49e0326f1157f3
43d8ce9d65a54846d378545770991e65838981e0 affected < b9f6845a492de20679b84bda6b08be347c5819da
43d8ce9d65a54846d378545770991e65838981e0 affected < d6d1af6b8611801b585c53c0cc63626c8d339e96
43d8ce9d65a54846d378545770991e65838981e0 affected < 82d2e01b95c439fe55fab5e04fc83387c42d3a48
43d8ce9d65a54846d378545770991e65838981e0 affected < b69edab47f1da8edd8e7bfdf8c70f51a2a5d89fb
Linux Linux affected
Version Status Constraints
5.2 affected —
0 unaffected < 5.2
5.4.243 unaffected ≤ 5.4.*
5.10.180 unaffected ≤ 5.10.*
5.15.111 unaffected ≤ 5.15.*
6.1.28 unaffected ≤ 6.1.*
6.2.15 unaffected ≤ 6.2.*
6.3.2 unaffected ≤ 6.3.*
6.4 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/4a07d2d511e2703efd4387891d49e0326f1157f3 cve-icon cve-icon
https://git.kernel.org/stable/c/719459877d58c8aced5845c1e5b98d8d87d09197 cve-icon cve-icon
https://git.kernel.org/stable/c/82d2e01b95c439fe55fab5e04fc83387c42d3a48 cve-icon cve-icon
https://git.kernel.org/stable/c/b69edab47f1da8edd8e7bfdf8c70f51a2a5d89fb cve-icon cve-icon
https://git.kernel.org/stable/c/b9f6845a492de20679b84bda6b08be347c5819da cve-icon cve-icon
https://git.kernel.org/stable/c/d6d1af6b8611801b585c53c0cc63626c8d339e96 cve-icon cve-icon
https://git.kernel.org/stable/c/fcd2da2e6bf2640a31a2a5b118b50dc3635c707b cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025122426-CVE-2023-54056-fd56@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-54056 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-54056 cve-icon
History

Thu, 25 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Wed, 24 Dec 2025 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: kheaders: Use array declaration instead of char Under CONFIG_FORTIFY_SOURCE, memcpy() will check the size of destination and source buffers. Defining kernel_headers_data as "char" would trip this check. Since these addresses are treated as byte arrays, define them as arrays (as done everywhere else). This was seen with: $ cat /sys/kernel/kheaders.tar.xz >> /dev/null detected buffer overflow in memcpy kernel BUG at lib/string_helpers.c:1027! ... RIP: 0010:fortify_panic+0xf/0x20 [...] Call Trace: <TASK> ikheaders_read+0x45/0x50 [kheaders] kernfs_fop_read_iter+0x1a4/0x2f0 ...
Title kheaders: Use array declaration instead of char
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-24T12:23:04.559Z

Reserved: 2025-12-24T12:21:05.091Z

Link: CVE-2023-54056

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-24T13:16:07.320

Modified: 2025-12-29T15:58:34.503

Link: CVE-2023-54056

cve-icon Redhat

Severity : Low

Publid Date: 2025-12-24T00:00:00Z

Links: CVE-2023-54056 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.