CVE-2023-53590
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-04

Last updated on: 2026-03-21

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop With this refcnt added in sctp_stream_priorities, we don't need to traverse all streams to check if the prio is used by other streams when freeing one stream's prio in sctp_sched_prio_free_sid(). This can avoid a nested loop (up to 65535 * 65535), which may cause a stuck as Ying reported: watchdog: BUG: soft lockup - CPU#23 stuck for 26s! [ksoftirqd/23:136] Call Trace: <TASK> sctp_sched_prio_free_sid+0xab/0x100 [sctp] sctp_stream_free_ext+0x64/0xa0 [sctp] sctp_stream_free+0x31/0x50 [sctp] sctp_association_free+0xa5/0x200 [sctp] Note that it doesn't need to use refcount_t type for this counter, as its accessing is always protected under the sock lock. v1->v2: - add a check in sctp_sched_prio_set to avoid the possible prio_head refcnt overflow.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-04
Last Modified
2026-03-21
Generated
2026-05-07
AI Q&A
2025-10-04
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 8 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.1
linux linux_kernel 6.1
linux linux_kernel From 6.2 (inc) to 6.2.5 (exc)
linux linux_kernel From 5.10.158 (inc) to 5.10.173 (exc)
linux linux_kernel From 5.15.82 (inc) to 5.15.100 (exc)
linux linux_kernel From 5.4.226 (inc) to 5.4.235 (exc)
linux linux_kernel From 6.0.12 (inc) to 6.1 (exc)
linux linux_kernel From 6.1.1 (inc) to 6.1.18 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-667 The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation involves a nested loop issue caused by the lack of a reference count in sctp_stream_priorities. Without this refcount, freeing a stream's priority required traversing all streams to check if the priority was used by others, potentially causing a nested loop with very high iterations (up to 65535 * 65535). This could lead to the CPU getting stuck (soft lockup). The fix adds a reference count to avoid this nested loop and includes a check to prevent refcount overflow.


How can this vulnerability impact me? :

This vulnerability can cause the CPU to become stuck or experience a soft lockup due to the nested loop in the SCTP stream priority handling. This can lead to system instability or degraded performance, potentially affecting the availability and reliability of systems using the affected Linux kernel SCTP implementation.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart