CVE-2023-53233
Estado: ModificadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix deadlock triggered by cancel_delayed_work_syn()
Detalles técnicos trazas, registros y código del informe original
The following LOCKDEP was detected:
Workqueue: events smc_lgr_free_work [smc]
WARNING: possible circular locking dependency detected
6.1.0-20221027.rc2.git8.56bc5b569087.300.fc36.s390x+debug #1 Not tainted
------------------------------------------------------
kworker/3:0/176251 is trying to acquire lock:
00000000f1467148 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0},
at: __flush_workqueue+0x7a/0x4f0
but task is already holding lock:
0000037fffe97dc8 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0},
at: process_one_work+0x232/0x730
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0}:
__lock_acquire+0x58e/0xbd8
lock_acquire.part.0+0xe2/0x248
lock_acquire+0xac/0x1c8
__flush_work+0x76/0xf0
__cancel_work_timer+0x170/0x220
__smc_lgr_terminate.part.0+0x34/0x1c0 [smc]
smc_connect_rdma+0x15e/0x418 [smc]
__smc_connect+0x234/0x480 [smc]
smc_connect+0x1d6/0x230 [smc]
__sys_connect+0x90/0xc0
__do_sys_socketcall+0x186/0x370
__do_syscall+0x1da/0x208
system_call+0x82/0xb0
-> #3 (smc_client_lgr_pending){+.+.}-{3:3}:
__lock_acquire+0x58e/0xbd8
lock_acquire.part.0+0xe2/0x248
lock_acquire+0xac/0x1c8
__mutex_lock+0x96/0x8e8
mutex_lock_nested+0x32/0x40
smc_connect_rdma+0xa4/0x418 [smc]
__smc_connect+0x234/0x480 [smc]
smc_connect+0x1d6/0x230 [smc]
__sys_connect+0x90/0xc0
__do_sys_socketcall+0x186/0x370
__do_syscall+0x1da/0x208
system_call+0x82/0xb0
-> #2 (sk_lock-AF_SMC){+.+.}-{0:0}:
__lock_acquire+0x58e/0xbd8
lock_acquire.part.0+0xe2/0x248
lock_acquire+0xac/0x1c8
lock_sock_nested+0x46/0xa8
smc_tx_work+0x34/0x50 [smc]
process_one_work+0x30c/0x730
worker_thread+0x62/0x420
kthread+0x138/0x150
__ret_from_fork+0x3c/0x58
ret_from_fork+0xa/0x40
-> #1 ((work_completion)(&(&smc->conn.tx_work)->work)){+.+.}-{0:0}:
__lock_acquire+0x58e/0xbd8
lock_acquire.part.0+0xe2/0x248
lock_acquire+0xac/0x1c8
process_one_work+0x2bc/0x730
worker_thread+0x62/0x420
kthread+0x138/0x150
__ret_from_fork+0x3c/0x58
ret_from_fork+0xa/0x40
-> #0 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0}:
check_prev_add+0xd8/0xe88
validate_chain+0x70c/0xb20
__lock_acquire+0x58e/0xbd8
lock_acquire.part.0+0xe2/0x248
lock_acquire+0xac/0x1c8
__flush_workqueue+0xaa/0x4f0
drain_workqueue+0xaa/0x158
destroy_workqueue+0x44/0x2d8
smc_lgr_free+0x9e/0xf8 [smc]
process_one_work+0x30c/0x730
worker_thread+0x62/0x420
kthread+0x138/0x150
__ret_from_fork+0x3c/0x58
ret_from_fork+0xa/0x40
other info that might help us debug this:
Chain exists of:
(wq_completion)smc_tx_wq-00000000#2
--> smc_client_lgr_pending
--> (work_completion)(&(&lgr->free_work)->work)
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock((work_completion)(&(&lgr->free_work)->work));
lock(smc_client_lgr_pending);
lock((work_completion)
(&(&lgr->free_work)->work));
lock((wq_completion)smc_tx_wq-00000000#2);
*** DEADLOCK ***
2 locks held by kworker/3:0/176251:
#0: 0000000080183548
((wq_completion)events){+.+.}-{0:0},
at: process_one_work+0x232/0x730
#1: 0000037fffe97dc8
((work_completion)
(&(&lgr->free_work)->work)){+.+.}-{0:0},
at: process_one_work+0x232/0x730
stack backtr
---truncated---CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.12%
- Percentil entre todas las CVEs puntuadas: 2
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-667
- CWE-667
Referencias
- https://git.kernel.org/stable/c/13085e1b5cab8ad802904d72e6a6dae85ae0cd20
- https://git.kernel.org/stable/c/3517584cf1b35bd02f4a90267ddf9dcf17bd9c87
- https://git.kernel.org/stable/c/9708efad9ba5095b9bb7916e11a135b3bd66c071
- https://git.kernel.org/stable/c/b615238e5bc01e13dc0610febddc1ca99bab1df6
- https://git.kernel.org/stable/c/c9ca2257150272df1b8d9ebe5059197ffea6e913
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-53233",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-53233",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-01-14T17:55:41.706072Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a52bcc919b14c9d78f03b2b4ff604e5ca69c7e6d",
"lessThan": "9708efad9ba5095b9bb7916e11a135b3bd66c071",
"versionType": "git"
},
{
"status": "affected",
"version": "a52bcc919b14c9d78f03b2b4ff604e5ca69c7e6d",
"lessThan": "b615238e5bc01e13dc0610febddc1ca99bab1df6",
"versionType": "git"
},
{
"status": "affected",
"version": "a52bcc919b14c9d78f03b2b4ff604e5ca69c7e6d",
"lessThan": "3517584cf1b35bd02f4a90267ddf9dcf17bd9c87",
"versionType": "git"
},
{
"status": "affected",
"version": "a52bcc919b14c9d78f03b2b4ff604e5ca69c7e6d",
"lessThan": "c9ca2257150272df1b8d9ebe5059197ffea6e913",
"versionType": "git"
},
{
"status": "affected",
"version": "a52bcc919b14c9d78f03b2b4ff604e5ca69c7e6d",
"lessThan": "13085e1b5cab8ad802904d72e6a6dae85ae0cd20",
"versionType": "git"
}
],
"programFiles": [
"net/smc/smc_core.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.8",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.176",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.104",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.21",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.2.8",
"versionType": "semver",
"lessThanOrEqual": "6.2.*"
},
{
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/smc/smc_core.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-09-15T15:15:50.297",
"references": [
{
"url": "https://git.kernel.org/stable/c/13085e1b5cab8ad802904d72e6a6dae85ae0cd20",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3517584cf1b35bd02f4a90267ddf9dcf17bd9c87",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9708efad9ba5095b9bb7916e11a135b3bd66c071",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b615238e5bc01e13dc0610febddc1ca99bab1df6",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c9ca2257150272df1b8d9ebe5059197ffea6e913",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-667"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-667"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix deadlock triggered by cancel_delayed_work_syn()\n\nThe following LOCKDEP was detected:\n\t\tWorkqueue: events smc_lgr_free_work [smc]\n\t\tWARNING: possible circular locking dependency detected\n\t\t6.1.0-20221027.rc2.git8.56bc5b569087.300.fc36.s390x+debug #1 Not tainted\n\t\t------------------------------------------------------\n\t\tkworker/3:0/176251 is trying to acquire lock:\n\t\t00000000f1467148 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0},\n\t\t\tat: __flush_workqueue+0x7a/0x4f0\n\t\tbut task is already holding lock:\n\t\t0000037fffe97dc8 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0},\n\t\t\tat: process_one_work+0x232/0x730\n\t\twhich lock already depends on the new lock.\n\t\tthe existing dependency chain (in reverse order) is:\n\t\t-> #4 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0}:\n\t\t __lock_acquire+0x58e/0xbd8\n\t\t lock_acquire.part.0+0xe2/0x248\n\t\t lock_acquire+0xac/0x1c8\n\t\t __flush_work+0x76/0xf0\n\t\t __cancel_work_timer+0x170/0x220\n\t\t __smc_lgr_terminate.part.0+0x34/0x1c0 [smc]\n\t\t smc_connect_rdma+0x15e/0x418 [smc]\n\t\t __smc_connect+0x234/0x480 [smc]\n\t\t smc_connect+0x1d6/0x230 [smc]\n\t\t __sys_connect+0x90/0xc0\n\t\t __do_sys_socketcall+0x186/0x370\n\t\t __do_syscall+0x1da/0x208\n\t\t system_call+0x82/0xb0\n\t\t-> #3 (smc_client_lgr_pending){+.+.}-{3:3}:\n\t\t __lock_acquire+0x58e/0xbd8\n\t\t lock_acquire.part.0+0xe2/0x248\n\t\t lock_acquire+0xac/0x1c8\n\t\t __mutex_lock+0x96/0x8e8\n\t\t mutex_lock_nested+0x32/0x40\n\t\t smc_connect_rdma+0xa4/0x418 [smc]\n\t\t __smc_connect+0x234/0x480 [smc]\n\t\t smc_connect+0x1d6/0x230 [smc]\n\t\t __sys_connect+0x90/0xc0\n\t\t __do_sys_socketcall+0x186/0x370\n\t\t __do_syscall+0x1da/0x208\n\t\t system_call+0x82/0xb0\n\t\t-> #2 (sk_lock-AF_SMC){+.+.}-{0:0}:\n\t\t __lock_acquire+0x58e/0xbd8\n\t\t lock_acquire.part.0+0xe2/0x248\n\t\t lock_acquire+0xac/0x1c8\n\t\t lock_sock_nested+0x46/0xa8\n\t\t smc_tx_work+0x34/0x50 [smc]\n\t\t process_one_work+0x30c/0x730\n\t\t worker_thread+0x62/0x420\n\t\t kthread+0x138/0x150\n\t\t __ret_from_fork+0x3c/0x58\n\t\t ret_from_fork+0xa/0x40\n\t\t-> #1 ((work_completion)(&(&smc->conn.tx_work)->work)){+.+.}-{0:0}:\n\t\t __lock_acquire+0x58e/0xbd8\n\t\t lock_acquire.part.0+0xe2/0x248\n\t\t lock_acquire+0xac/0x1c8\n\t\t process_one_work+0x2bc/0x730\n\t\t worker_thread+0x62/0x420\n\t\t kthread+0x138/0x150\n\t\t __ret_from_fork+0x3c/0x58\n\t\t ret_from_fork+0xa/0x40\n\t\t-> #0 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0}:\n\t\t check_prev_add+0xd8/0xe88\n\t\t validate_chain+0x70c/0xb20\n\t\t __lock_acquire+0x58e/0xbd8\n\t\t lock_acquire.part.0+0xe2/0x248\n\t\t lock_acquire+0xac/0x1c8\n\t\t __flush_workqueue+0xaa/0x4f0\n\t\t drain_workqueue+0xaa/0x158\n\t\t destroy_workqueue+0x44/0x2d8\n\t\t smc_lgr_free+0x9e/0xf8 [smc]\n\t\t process_one_work+0x30c/0x730\n\t\t worker_thread+0x62/0x420\n\t\t kthread+0x138/0x150\n\t\t __ret_from_fork+0x3c/0x58\n\t\t ret_from_fork+0xa/0x40\n\t\tother info that might help us debug this:\n\t\tChain exists of:\n\t\t (wq_completion)smc_tx_wq-00000000#2\n\t \t --> smc_client_lgr_pending\n\t\t --> (work_completion)(&(&lgr->free_work)->work)\n\t\t Possible unsafe locking scenario:\n\t\t CPU0 CPU1\n\t\t ---- ----\n\t\t lock((work_completion)(&(&lgr->free_work)->work));\n\t\t lock(smc_client_lgr_pending);\n\t\t lock((work_completion)\n\t\t\t\t\t(&(&lgr->free_work)->work));\n\t\t lock((wq_completion)smc_tx_wq-00000000#2);\n\t\t *** DEADLOCK ***\n\t\t2 locks held by kworker/3:0/176251:\n\t\t #0: 0000000080183548\n\t\t\t((wq_completion)events){+.+.}-{0:0},\n\t\t\t\tat: process_one_work+0x232/0x730\n\t\t #1: 0000037fffe97dc8\n\t\t\t((work_completion)\n\t\t\t (&(&lgr->free_work)->work)){+.+.}-{0:0},\n\t\t\t\tat: process_one_work+0x232/0x730\n\t\tstack backtr\n---truncated---"
}
],
"lastModified": "2026-06-17T06:44:34.857",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "316AAE8F-666C-4A6E-989F-E3C02A37F7C2",
"versionEndExcluding": "5.10.176",
"versionStartIncluding": "5.8"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB8A3D70-3EE1-4B1C-8A21-21CA7356DCA7",
"versionEndExcluding": "5.15.104",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F1CA6A9-8F4D-408D-9116-868EC067DCD9",
"versionEndExcluding": "6.1.21",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4011EC6B-7786-4709-B765-186FA31D6F7F",
"versionEndExcluding": "6.2.8",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8E3B0E8-FA27-4305-87BB-AF6C25B160CB"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A47F0FC3-CE52-4BA1-BA51-22F783938431"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}