CVE-2023-54268 debugobjects: Don't wake up kswapd from fill_pool()
A locking issue in the Linux kernel debugobjects subsystem can cause a deadlock or system hang when memory allocation triggers kswapd wakeups.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-54268?
CVE-2023-54268 is a denial of service vulnerability in Linux, published on 30 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
debugobjects: Don't wake up kswapd from fill_pool()
syzbot is reporting a lockdep warning in fill_pool() because the allocation from debugobjects is using GFP_ATOMIC, which is (__GFP_HIGH | __GFP_KSWAPD_RECLAIM) and therefore tries to wake up kswapd, which acquires kswapd_wait::lock.
Since fill_pool() might be called with arbitrary locks held, fill_pool() should not assume that acquiring kswapd_wait::lock is safe.
Use __GFP_HIGH instead and remove __GFP_NORETRY as it is pointless for !__GFP_DIRECT_RECLAIM allocation.
Which versions are affected by CVE-2023-54268?
How do I fix CVE-2023-54268?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-54268 being exploited?
There is no known exploitation of CVE-2023-54268 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-54268, DEBIAN-CVE-2023-54268, GHSA-wfjg-crvw-f25h, UBUNTU-CVE-2023-54268.