BaseFortify

Publication date: 2025-10-01

Last updated on: 2025-10-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: start_kernel: Add __no_stack_protector function attribute Back during the discussion of commit a9a3ed1eff36 ("x86: Fix early boot crash on gcc-10, third try") we discussed the need for a function attribute to control the omission of stack protectors on a per-function basis; at the time Clang had support for no_stack_protector but GCC did not. This was fixed in gcc-11. Now that the function attribute is available, let's start using it. Callers of boot_init_stack_canary need to use this function attribute unless they're compiled with -fno-stack-protector, otherwise the canary stored in the stack slot of the caller will differ upon the call to boot_init_stack_canary. This will lead to a call to __stack_chk_fail() then panic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-01

Last Modified

2025-10-02

Generated

2026-07-06

AI Q&A

2025-10-01

EPSS Evaluated

2026-07-05

NVD

CVE-2023-53491

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Impact Analysis

If this vulnerability is present, it can cause the Linux kernel to panic during early boot due to stack canary mismatches, potentially leading to system crashes and denial of service.

Executive Summary

This vulnerability relates to the Linux kernel's early boot process where a function attribute called __no_stack_protector was added to control the omission of stack protectors on a per-function basis. Without this attribute, callers of boot_init_stack_canary may have mismatched stack canaries, causing a call to __stack_chk_fail() and resulting in a kernel panic.

Hi! I’m here to help you understand CVE-2023-53491. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70