In the Linux kernel, the following vulnerability has been resolved:

powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT

lppaca_shared_proc() takes a pointer to the lppaca which is typically
accessed through get_lppaca(). With DEBUG_PREEMPT enabled, this leads
to checking if preemption is enabled, for example:

BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693
caller is lparcfg_data+0x408/0x19a0
CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2
Call Trace:
dump_stack_lvl+0x154/0x200 (unreliable)
check_preemption_disabled+0x214/0x220
lparcfg_data+0x408/0x19a0
...

This isn't actually a problem however, as it does not matter which
lppaca is accessed, the shared proc state will be the same.
vcpudispatch_stats_procfs_init() already works around this by disabling
preemption, but the lparcfg code does not, erroring any time
/proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled.

Instead of disabling preemption on the caller side, rework
lppaca_shared_proc() to not take a pointer and instead directly access
the lppaca, bypassing any potential preemption checks.

[mpe: Rework to avoid needing a definition in paca.h and lppaca.h]

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00035.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
f13c13a005127b5dc5daaca190277a062d946e63 affected < 953c54dfdc5d3eb7243ed902b50acb5ea1db4355
f13c13a005127b5dc5daaca190277a062d946e63 affected < 2935443dc9c28499223d8c881474259e4b998f2a
f13c13a005127b5dc5daaca190277a062d946e63 affected < 4c8568cf4c45b415854195c8832b557cdefba57a
f13c13a005127b5dc5daaca190277a062d946e63 affected < 3c5e8e666794d7dde6d14ea846c6c04f2bb34900
f13c13a005127b5dc5daaca190277a062d946e63 affected < f45ee5c074013a0fbfce77a5af5efddb01f5d4f4
f13c13a005127b5dc5daaca190277a062d946e63 affected < eac030b22ea12cdfcbb2e941c21c03964403c63f
Linux Linux affected
Version Status Constraints
3.12 affected —
0 unaffected < 3.12
5.10.195 unaffected ≤ 5.10.*
5.15.132 unaffected ≤ 5.15.*
6.1.53 unaffected ≤ 6.1.*
6.4.16 unaffected ≤ 6.4.*
6.5.3 unaffected ≤ 6.5.*
6.6 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2935443dc9c28499223d8c881474259e4b998f2a cve-icon cve-icon
https://git.kernel.org/stable/c/3c5e8e666794d7dde6d14ea846c6c04f2bb34900 cve-icon cve-icon
https://git.kernel.org/stable/c/4c8568cf4c45b415854195c8832b557cdefba57a cve-icon cve-icon
https://git.kernel.org/stable/c/953c54dfdc5d3eb7243ed902b50acb5ea1db4355 cve-icon cve-icon
https://git.kernel.org/stable/c/eac030b22ea12cdfcbb2e941c21c03964403c63f cve-icon cve-icon
https://git.kernel.org/stable/c/f45ee5c074013a0fbfce77a5af5efddb01f5d4f4 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025123059-CVE-2023-54267-6736@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-54267 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-54267 cve-icon
History

Wed, 31 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Tue, 30 Dec 2025 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT lppaca_shared_proc() takes a pointer to the lppaca which is typically accessed through get_lppaca(). With DEBUG_PREEMPT enabled, this leads to checking if preemption is enabled, for example: BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693 caller is lparcfg_data+0x408/0x19a0 CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2 Call Trace: dump_stack_lvl+0x154/0x200 (unreliable) check_preemption_disabled+0x214/0x220 lparcfg_data+0x408/0x19a0 ... This isn't actually a problem however, as it does not matter which lppaca is accessed, the shared proc state will be the same. vcpudispatch_stats_procfs_init() already works around this by disabling preemption, but the lparcfg code does not, erroring any time /proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled. Instead of disabling preemption on the caller side, rework lppaca_shared_proc() to not take a pointer and instead directly access the lppaca, bypassing any potential preemption checks. [mpe: Rework to avoid needing a definition in paca.h and lppaca.h]
Title powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-30T12:15:58.914Z

Reserved: 2025-12-30T12:06:44.518Z

Link: CVE-2023-54267

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-30T13:16:15.517

Modified: 2025-12-31T20:42:43.210

Link: CVE-2023-54267

cve-icon Redhat

Severity : Low

Publid Date: 2025-12-30T00:00:00Z

Links: CVE-2023-54267 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.