CVE-2023-53620
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-07

Last updated on: 2026-02-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: md: fix soft lockup in status_resync status_resync() will calculate 'curr_resync - recovery_active' to show user a progress bar like following: [============>........] resync = 61.4% 'curr_resync' and 'recovery_active' is updated in md_do_sync(), and status_resync() can read them concurrently, hence it's possible that 'curr_resync - recovery_active' can overflow to a huge number. In this case status_resync() will be stuck in the loop to print a large amount of '=', which will end up soft lockup. Fix the problem by setting 'resync' to MD_RESYNC_ACTIVE in this case, this way resync in progress will be reported to user.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-07
Last Modified
2026-02-05
Generated
2026-06-16
AI Q&A
2025-10-07
EPSS Evaluated
2026-06-15
NVD
CVE-2023-53620
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel 2.6.12
linux linux_kernel From 5.15.160 (inc) to 5.16 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-667 The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs in the Linux kernel's md (multiple device) subsystem where the status_resync() function calculates a progress value by subtracting 'recovery_active' from 'curr_resync'. Because these values are updated concurrently without synchronization, the subtraction can overflow to a very large number. This causes status_resync() to enter a loop printing a large number of '=' characters, resulting in a soft lockup (the system appears to hang). The fix sets the progress value to a constant (MD_RESYNC_ACTIVE) when an overflow would occur, preventing the lockup and correctly reporting resync progress.

Impact Analysis

This vulnerability can cause a soft lockup in the Linux kernel during disk resynchronization, which means the system may become unresponsive or hang temporarily. This can disrupt normal operations, potentially causing downtime or degraded performance while the resync status is being reported incorrectly.

Mitigation Strategies

Apply the patch or update to the fixed Linux kernel version that resolves the soft lockup issue in status_resync(). This fix prevents the overflow condition causing the soft lockup by correctly setting the resync progress indicator.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-53620. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart