{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2023-54160 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2023-54160 is a denial of service vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-54160 and fix it if it is affected.\n\nWhat it is: CVE-2023-54160 is a denial of service vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-54160 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-54160/ (Markdown: https://insights.sbomify.com/CVE-2023-54160/index.md)","id":"CVE-2023-54160","markdown":"https://insights.sbomify.com/CVE-2023-54160/index.md","name":"CVE-2023-54160","record":{"aliases":["BELL-CVE-2023-54160","DEBIAN-CVE-2023-54160","GHSA-jfm8-wf93-6c4c","UBUNTU-CVE-2023-54160"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel","requires_auth":"none","summary":"A bug in the Linux kernel SDEI driver causes a system crash when running a preempt-rt kernel, leading to denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_sdei: Fix sleep from invalid context BUG\n\nRunning a preempt-rt (v6.2-rc3-rt1) based kernel on an Ampere Altra\ntriggers:\n\n  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46\n  in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 24, name: cpuhp/0\n  preempt_count: 0, expected: 0\n  RCU nest depth: 0, expected: 0\n  3 locks held by cpuhp/0/24:\n    #0: ffffda30217c70d0 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248\n    #1: ffffda30217c7120 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248\n    #2: ffffda3021c711f0 (sdei_list_lock){....}-{3:3}, at: sdei_cpuhp_up+0x3c/0x130\n  irq event stamp: 36\n  hardirqs last  enabled at (35): [\u003cffffda301e85b7bc\u003e] finish_task_switch+0xb4/0x2b0\n  hardirqs last disabled at (36): [\u003cffffda301e812fec\u003e] cpuhp_thread_fun+0x21c/0x248\n  softirqs last  enabled at (0): [\u003cffffda301e80b184\u003e] copy_process+0x63c/0x1ac0\n  softirqs last disabled at (0): [\u003c0000000000000000\u003e] 0x0\n  CPU: 0 PID: 24 Comm: cpuhp/0 Not tainted 5.19.0-rc3-rt5-[...]\n  Hardware name: WIWYNN Mt.Jade Server [...]\n  Call trace:\n    dump_backtrace+0x114/0x120\n    show_stack+0x20/0x70\n    dump_stack_lvl+0x9c/0xd8\n    dump_stack+0x18/0x34\n    __might_resched+0x188/0x228\n    rt_spin_lock+0x70/0x120\n    sdei_cpuhp_up+0x3c/0x130\n    cpuhp_invoke_callback+0x250/0xf08\n    cpuhp_thread_fun+0x120/0x248\n    smpboot_thread_fn+0x280/0x320\n    kthread+0x130/0x140\n    ret_from_fork+0x10/0x20\n\nsdei_cpuhp_up() is called in the STARTING hotplug section,\nwhich runs with interrupts disabled. Use a CPUHP_AP_ONLINE_DYN entry\ninstead to execute the cpuhp cb later, with preemption enabled.\n\nSDEI originally got its own cpuhp slot to allow interacting\nwith perf. It got superseded by pNMI and this early slot is not\nrelevant anymore. [1]\n\nSome SDEI calls (e.g. SDEI_1_0_FN_SDEI_PE_MASK) take actions on the\ncalling CPU. It is checked that preemption is disabled for them.\n_ONLINE cpuhp cb are executed in the 'per CPU hotplug thread'.\nPreemption is enabled in those threads, but their cpumask is limited\nto 1 CPU.\nMove 'WARN_ON_ONCE(preemptible())' statements so that SDEI cpuhp cb\ndon't trigger them.\n\nAlso add a check for the SDEI_1_0_FN_SDEI_PRIVATE_RESET SDEI call\nwhich acts on the calling CPU.\n\n[1]:\nhttps://lore.kernel.org/all/5813b8c5-ae3e-87fd-fccc-94c9cd08816d@arm.com/","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"firmware: arm_sdei: Fix sleep from invalid context BUG","id":"CVE-2023-54160","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2023"},"n_packages":0,"n_references":7,"next":{"headline":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","id":"CVE-2023-54161"},"packages":[],"prev":{"headline":"usb: mtu3: fix kernel panic at qmu transfer done irq handler","id":"CVE-2023-54159"},"products":["Linux"],"published":"2025-12-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A bug in the Linux kernel SDEI driver causes a system crash when running a preempt-rt kernel, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2023-54160/"}