CVE-2023-53519
BaseFortify
Publication date: 2025-10-01
Last updated on: 2026-04-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a data race condition in the Linux kernel's media subsystem, specifically in the v4l2-mem2mem driver. It occurs because the parameter 'num_rdy' is accessed without proper locking, leading to concurrent read-write operations that can cause unpredictable behavior or crashes. The issue was detected using KCSAN (Kernel Concurrency Sanitizer) and fixed by adding a lock to protect 'num_rdy' during access.
How can this vulnerability impact me? :
This vulnerability can cause instability or crashes in the Linux kernel's media subsystem when using the v4l2-mem2mem driver. It may lead to unpredictable behavior in applications relying on video memory-to-memory operations, potentially affecting system reliability and performance.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by using KCSAN (Kernel Concurrency Sanitizer) to check the v4l2-mem2mem driver for data races. The error messages to look for include BUG reports indicating data-race in v4l2_m2m_buf_queue, such as: 'BUG: KCSAN: data-race in v4l2_m2m_buf_queue' and read-write conflicts on the parameter num_rdy. Specific commands would involve running KCSAN-enabled kernel tests targeting the v4l2-mem2mem driver, but exact commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the patch that adds a lock to protect the parameter num_rdy in the v4l2-mem2mem driver, specifically in the functions v4l2_m2m_num_src_bufs_ready and v4l2_m2m_num_dst_bufs_ready. Until the patch is applied, avoid using the affected driver features that trigger the data race. No other specific mitigation steps are provided.