CVE-2023-54145

bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log

State
Published
Severity
Not scored
Published
Dec 24, 2025
Updated
May 11, 2026
Reserved
Dec 24, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log

It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at least two pieces of user-provided information that can be output through this buffer, and both can be arbitrarily sized by user: - BTF names; - BTF.ext source code lines strings.

Verifier log buffer should be properly sized for typical verifier state output. But it's sort-of expected that this buffer won't be long enough in some circumstances. So let's drop the check. In any case code will work correctly, at worst truncating a part of a single line output.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • a2a7d5701052542cd2260e7659b12443e0a74733 to before 40c88c429a598006f91ad7a2b89856cd50b3a008Affected
  • a2a7d5701052542cd2260e7659b12443e0a74733 to before 926a175026fed5d534f587ea4ec3ec49265cd3c5Affected
  • a2a7d5701052542cd2260e7659b12443e0a74733 to before cff36398bd4c7d322d424433db437f3c3391c491Affected
LinuxLinux
  • 4.15Affected
  • before 4.15Not affected
  • 6.1.107 through 6.1.*Not affected
  • 6.4.7 through 6.4.*Not affected
  • 6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.