CVE-2023-54246
Hung Task Timeout Vulnerability in Linux Kernel rcuscale Module
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.4.0-rc1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Linux kernel's rcuscale module, specifically the rcu_scale_writer() function. The issue is that the function uses schedule_timeout_uninterruptible(), which can cause the rcu_scale_writer() kernel thread to be blocked longer than expected when the rcuscale.holdoff parameter is set to a value greater than the hung_task_timeout_secs. This leads to hung-task timeout warnings and potential delays in kernel thread scheduling. The fix replaces schedule_timeout_uninterruptible() with schedule_timeout_idle() to prevent this blocking behavior.
How can this vulnerability impact me? :
This vulnerability can cause the rcu_scale_writer() kernel thread to become blocked for extended periods, potentially leading to hung-task timeout warnings and degraded system responsiveness or performance. It may affect system stability under certain configurations where rcuscale.holdoff is set high, causing delays in kernel thread execution.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for hung tasks related to the rcu_scale_writer process. Specifically, look for messages indicating that the task 'rcu_scale_write' is blocked for more than the hung task timeout period. You can check kernel logs using commands like 'dmesg | grep rcu_scale_write' or 'journalctl -k | grep rcu_scale_write'. Additionally, adjusting or checking the value of '/proc/sys/kernel/hung_task_timeout_secs' can help in tuning detection sensitivity.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Linux kernel to a version where this vulnerability is resolved, which involves replacing schedule_timeout_uninterruptible() with schedule_timeout_idle() in the rcu_scale_writer() function. As a temporary measure, you can disable hung task timeout messages by running 'echo 0 > /proc/sys/kernel/hung_task_timeout_secs', but this does not fix the underlying issue. Adjusting the 'rcuscale.holdoff' module parameter to a value less than 'hung_task_timeout_secs' can also help avoid triggering the hung-task timeout.