CVE-2023-53624
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-07

Last updated on: 2026-02-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq: fix integer overflow of "credit" if sch_fq is configured with "initial quantum" having values greater than INT_MAX, the first assignment of "credit" does signed integer overflow to a very negative value. In this situation, the syzkaller script provided by Cristoph triggers the CPU soft-lockup warning even with few sockets. It's not an infinite loop, but "credit" wasn't probably meant to be minus 2Gb for each new flow. Capping "initial quantum" to INT_MAX proved to fix the issue. v2: validation of "initial quantum" is done in fq_policy, instead of open coding in fq_change() _ suggested by Jakub Kicinski
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-07
Last Modified
2026-02-05
Generated
2026-05-07
AI Q&A
2025-10-07
EPSS Evaluated
2026-05-05
NVD
CVE-2023-53624
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an integer overflow issue in the Linux kernel's net/sched sch_fq module. When sch_fq is configured with an "initial quantum" value greater than INT_MAX, the "credit" variable overflows and becomes a very negative number. This causes unexpected behavior such as CPU soft-lockup warnings triggered by certain scripts, although it is not an infinite loop. The issue was fixed by capping the "initial quantum" value to INT_MAX and validating it properly.


How can this vulnerability impact me? :

If exploited, this vulnerability can cause CPU soft-lockup warnings due to the integer overflow in the "credit" variable, potentially affecting system stability and performance. It may lead to degraded network scheduling behavior and resource management issues on affected Linux systems.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, ensure that the Linux kernel is updated to a version where the sch_fq scheduler properly validates the "initial quantum" parameter, capping it to INT_MAX. This prevents the integer overflow issue. Applying the patch that moves validation to fq_policy and updates the kernel to include this fix is recommended.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart