CVE-2023-53727
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-10-22
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is in the Linux kernel's fq_pie network scheduler component. When a very high number of flows (up to 65536) are set, the fq_pie_timer() function takes too much CPU time, causing stalls. This happens because fq_pie_timer() scans all flows without yielding the CPU, potentially blocking other processes and causing system stalls. The fix adds logic to yield the CPU every 2048 flows to prevent long blocking and reduce stalls.
How can this vulnerability impact me? :
The vulnerability can cause the system to stall or become unresponsive when handling a very high number of network flows due to fq_pie_timer() consuming excessive CPU time. This can degrade system performance and affect the responsiveness of network-related operations or other processes on the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability relates to stalls caused by fq_pie_timer() in the Linux kernel when handling a high number of flows. Detection would involve monitoring for CPU stalls or expedited RCU stalls as indicated by kernel logs. You can check for RCU stalls and related kernel messages using commands like: 'dmesg | grep rcu' or 'journalctl -k | grep rcu'. Additionally, monitoring CPU usage and latency related to fq_pie qdisc might help. However, no specific commands for direct detection of this vulnerability are provided.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed, as the issue is resolved by adding logic to yield the CPU every 2048 flows in fq_pie_timer(). There are no other specific mitigation steps or workarounds provided.