CVE-2023-54056

kheaders: Use array declaration instead of char

State: Published
Severity: Not scored
Published: Dec 24, 2025
Updated: May 11, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

kheaders: Use array declaration instead of char

Under CONFIG_FORTIFY_SOURCE, memcpy() will check the size of destination and source buffers. Defining kernel_headers_data as "char" would trip this check. Since these addresses are treated as byte arrays, define them as arrays (as done everywhere else).

This was seen with:

$ cat /sys/kernel/kheaders.tar.xz >> /dev/null

detected buffer overflow in memcpy kernel BUG at lib/string_helpers.c:1027! ... RIP: 0010:fortify_panic+0xf/0x20 [...] Call Trace: <TASK> ikheaders_read+0x45/0x50 [kheaders] kernfs_fop_read_iter+0x1a4/0x2f0 ...

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	43d8ce9d65a54846d378545770991e65838981e0 to before 719459877d58c8aced5845c1e5b98d8d87d09197Affected 43d8ce9d65a54846d378545770991e65838981e0 to before fcd2da2e6bf2640a31a2a5b118b50dc3635c707bAffected 43d8ce9d65a54846d378545770991e65838981e0 to before 4a07d2d511e2703efd4387891d49e0326f1157f3Affected 43d8ce9d65a54846d378545770991e65838981e0 to before b9f6845a492de20679b84bda6b08be347c5819daAffected 43d8ce9d65a54846d378545770991e65838981e0 to before d6d1af6b8611801b585c53c0cc63626c8d339e96Affected 43d8ce9d65a54846d378545770991e65838981e0 to before 82d2e01b95c439fe55fab5e04fc83387c42d3a48Affected 43d8ce9d65a54846d378545770991e65838981e0 to before b69edab47f1da8edd8e7bfdf8c70f51a2a5d89fbAffected
LinuxLinux	5.2Affected before 5.2Not affected 5.4.243 through 5.4.Not affected 5.10.180 through 5.10.Not affected 5.15.111 through 5.15.Not affected 6.1.28 through 6.1.Not affected 6.2.15 through 6.2.Not affected 6.3.2 through 6.3.Not affected 6.4 and laterNot affected

Product

Versions

LinuxLinux

43d8ce9d65a54846d378545770991e65838981e0 to before 719459877d58c8aced5845c1e5b98d8d87d09197Affected
43d8ce9d65a54846d378545770991e65838981e0 to before fcd2da2e6bf2640a31a2a5b118b50dc3635c707bAffected
43d8ce9d65a54846d378545770991e65838981e0 to before 4a07d2d511e2703efd4387891d49e0326f1157f3Affected
43d8ce9d65a54846d378545770991e65838981e0 to before b9f6845a492de20679b84bda6b08be347c5819daAffected
43d8ce9d65a54846d378545770991e65838981e0 to before d6d1af6b8611801b585c53c0cc63626c8d339e96Affected
43d8ce9d65a54846d378545770991e65838981e0 to before 82d2e01b95c439fe55fab5e04fc83387c42d3a48Affected
43d8ce9d65a54846d378545770991e65838981e0 to before b69edab47f1da8edd8e7bfdf8c70f51a2a5d89fbAffected

LinuxLinux

5.2Affected
before 5.2Not affected
5.4.243 through 5.4.*Not affected
5.10.180 through 5.10.*Not affected
5.15.111 through 5.15.*Not affected
6.1.28 through 6.1.*Not affected
6.2.15 through 6.2.*Not affected
6.3.2 through 6.3.*Not affected
6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.