BaseFortify

Publication date: 2025-10-07

Last updated on: 2026-02-05

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: md: fix soft lockup in status_resync status_resync() will calculate 'curr_resync - recovery_active' to show user a progress bar like following: [============>........] resync = 61.4% 'curr_resync' and 'recovery_active' is updated in md_do_sync(), and status_resync() can read them concurrently, hence it's possible that 'curr_resync - recovery_active' can overflow to a huge number. In this case status_resync() will be stuck in the loop to print a large amount of '=', which will end up soft lockup. Fix the problem by setting 'resync' to MD_RESYNC_ACTIVE in this case, this way resync in progress will be reported to user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-07

Last Modified

2026-02-05

Generated

2026-07-06

AI Q&A

2025-10-07

EPSS Evaluated

2026-07-05

NVD

CVE-2023-53620

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	2.6.12
linux	linux_kernel	From 5.15.160 (inc) to 5.16 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-667	The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the Linux kernel's md (multiple device) subsystem where the status_resync() function calculates a progress value by subtracting 'recovery_active' from 'curr_resync'. Because these values are updated concurrently without synchronization, the subtraction can overflow to a very large number. This causes status_resync() to enter a loop printing a large number of '=' characters, resulting in a soft lockup (the system appears to hang). The fix sets the progress value to a constant (MD_RESYNC_ACTIVE) when an overflow would occur, preventing the lockup and correctly reporting resync progress.

Impact Analysis

This vulnerability can cause a soft lockup in the Linux kernel during disk resynchronization, which means the system may become unresponsive or hang temporarily. This can disrupt normal operations, potentially causing downtime or degraded performance while the resync status is being reported incorrectly.

Mitigation Strategies

Apply the patch or update to the fixed Linux kernel version that resolves the soft lockup issue in status_resync(). This fix prevents the overflow condition causing the soft lockup by correctly setting the resync progress indicator.

Hi! I’m here to help you understand CVE-2023-53620. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70