CVE-2023-53329
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-12-10
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.5 (inc) to 6.5.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a data race condition in the Linux kernel's workqueue subsystem. Specifically, it involves concurrent access to the pwq->stats[] array, where multiple threads can simultaneously read and write to the same memory location without proper synchronization. This can lead to inconsistent or corrupted data in the kernel's workqueue statistics. The issue was detected by the Kernel Concurrency Sanitizer (KCSAN) and fixed by reordering the increment operation to occur before releasing a lock, thus preventing the race condition without impacting performance.
How can this vulnerability impact me? :
This data race vulnerability can cause instability or unpredictable behavior in the Linux kernel's workqueue subsystem. It may lead to corrupted internal kernel data structures, which can result in system crashes, data corruption, or other reliability issues. While it does not directly expose a security breach like privilege escalation, the instability caused by the race condition can impact system availability and reliability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for data race warnings reported by the Kernel Concurrency Sanitizer (KCSAN). You can check the kernel log for messages indicating data races in process_one_work or related workqueue functions. For example, use the command: dmesg | grep -i 'KCSAN: data-race' to find relevant entries.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the data race in the workqueue subsystem has been fixed. The fix involves moving the increment of pwq->stats[PWQ_STAT_STARTED] before the raw_spin_unlock_irq(&pool->lock) line to resolve the data race without performance penalty. Until an update is applied, monitoring for related kernel warnings and avoiding workloads that heavily use workqueues may reduce risk.