CVE-2023-54145 bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
A local attacker can trigger a kernel warning by providing large BTF data, potentially causing log noise or resource exhaustion in the Linux kernel verifier.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-54145?
CVE-2023-54145 is a denial of service vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at least two pieces of user-provided information that can be output through this buffer, and both can be arbitrarily sized by user: - BTF names; - BTF.ext source code lines strings.
Verifier log buffer should be properly sized for typical verifier state output. But it's sort-of expected that this buffer won't be long enough in some circumstances. So let's drop the check. In any case code will work correctly, at worst truncating a part of a single line output.
Which versions are affected by CVE-2023-54145?
How do I fix CVE-2023-54145?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-54145 being exploited?
There is no known exploitation of CVE-2023-54145 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-54145, DEBIAN-CVE-2023-54145, GHSA-m575-6r3m-823p, ROOT-OS-DEBIAN-11-CVE-2023-54145, ROOT-OS-UBUNTU-2204-CVE-2023-54145, UBUNTU-CVE-2023-54145.