CVE-2023-54139 tracing/user_events: Ensure write index cannot be negative
A missing bounds check in Linux kernel user_events allows negative write indices, potentially leading to out-of-bounds memory access and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-54139?
CVE-2023-54139 is a high-severity memory corruption vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tracing/user_events: Ensure write index cannot be negative
The write index indicates which event the data is for and accesses a per-file array. The index is passed by user processes during write() calls as the first 4 bytes. Ensure that it cannot be negative by returning -EINVAL to prevent out of bounds accesses.
Update ftrace self-test to ensure this occurs properly.
Which versions are affected by CVE-2023-54139?
How do I fix CVE-2023-54139?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-54139 being exploited?
There is no known exploitation of CVE-2023-54139 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-54139, DEBIAN-CVE-2023-54139, GHSA-8m37-c7gh-2jmr, UBUNTU-CVE-2023-54139.