CVE-2023-54316

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

refscale: Fix uninitalized use of wait_queue_head_t

Running the refscale test occasionally crashes the kernel with the following error:

The likely cause is that init_waitqueue_head() is called after the call to the torture_create_kthread() function that creates the ref_scale_reader kthread. Although this init_waitqueue_head() call will very likely complete before this kthread is created and starts running, it is possible that the calling kthread will be delayed between the calls to torture_create_kthread() and init_waitqueue_head(). In this case, the new kthread will use the waitqueue head before it is properly initialized, which is not good for the kernel's health and well-being.

Leer descripción completaMostrar menos

The above crash happened here:

The offset of flags from list_head entry in wait_queue_entry is -0x18. If reader_tasks[i].wq.head.next is NULL as allocated reader_task structure is zero initialized, the instruction will try to access address 0xffffffffffffffe8, which is exactly the fault address listed above.

This commit therefore invokes init_waitqueue_head() before creating the kthread.

Detalles técnicos trazas, registros y código del informe original

[ 8569.952896] BUG: unable to handle page fault for address: ffffffffffffffe8
[ 8569.952900] #PF: supervisor read access in kernel mode
[ 8569.952902] #PF: error_code(0x0000) - not-present page
[ 8569.952904] PGD c4b048067 P4D c4b049067 PUD c4b04b067 PMD 0
[ 8569.952910] Oops: 0000 [#1] PREEMPT_RT SMP NOPTI
[ 8569.952916] Hardware name: Dell Inc. PowerEdge R750/0WMWCR, BIOS 1.2.4 05/28/2021
[ 8569.952917] RIP: 0010:prepare_to_wait_event+0x101/0x190
  :
[ 8569.952940] Call Trace:
[ 8569.952941]  <TASK>
[ 8569.952944]  ref_scale_reader+0x380/0x4a0 [refscale]
[ 8569.952959]  kthread+0x10e/0x130
[ 8569.952966]  ret_from_fork+0x1f/0x30
[ 8569.952973]  </TASK>

	static inline void __add_wait_queue(...)
	{
		:
		if (!(wq->flags & WQ_FLAG_PRIORITY)) <=== Crash here

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.19%
Percentil entre todas las CVEs puntuadas: 8
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2023-54316",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "653ed64b01dc5989f8f579d0038e987476c2c023",
              "lessThan": "066fbd8bc981cf49923bf828b7b4092894df577f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "653ed64b01dc5989f8f579d0038e987476c2c023",
              "lessThan": "ec9d118ad99dc6f1bc674c1e649c25533d89b9ba",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "653ed64b01dc5989f8f579d0038e987476c2c023",
              "lessThan": "e0322a255a2242dbe4686b6176b3c83dea490529",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "653ed64b01dc5989f8f579d0038e987476c2c023",
              "lessThan": "e5de968a9032366198720eac4f368ed7e690b3ef",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "653ed64b01dc5989f8f579d0038e987476c2c023",
              "lessThan": "70a2856fd1d0a040c876ba9e3f89b949ae92e4dd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "653ed64b01dc5989f8f579d0038e987476c2c023",
              "lessThan": "f5063e8948dad7f31adb007284a5d5038ae31bb8",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/rcu/refscale.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.9",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.195",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.132",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.4.16",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.*"
            },
            {
              "status": "unaffected",
              "version": "6.5.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.5.*"
            },
            {
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/rcu/refscale.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-30T13:16:20.867",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/066fbd8bc981cf49923bf828b7b4092894df577f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/70a2856fd1d0a040c876ba9e3f89b949ae92e4dd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e0322a255a2242dbe4686b6176b3c83dea490529",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e5de968a9032366198720eac4f368ed7e690b3ef",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ec9d118ad99dc6f1bc674c1e649c25533d89b9ba",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f5063e8948dad7f31adb007284a5d5038ae31bb8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrefscale: Fix uninitalized use of wait_queue_head_t\n\nRunning the refscale test occasionally crashes the kernel with the\nfollowing error:\n\n[ 8569.952896] BUG: unable to handle page fault for address: ffffffffffffffe8\n[ 8569.952900] #PF: supervisor read access in kernel mode\n[ 8569.952902] #PF: error_code(0x0000) - not-present page\n[ 8569.952904] PGD c4b048067 P4D c4b049067 PUD c4b04b067 PMD 0\n[ 8569.952910] Oops: 0000 [#1] PREEMPT_RT SMP NOPTI\n[ 8569.952916] Hardware name: Dell Inc. PowerEdge R750/0WMWCR, BIOS 1.2.4 05/28/2021\n[ 8569.952917] RIP: 0010:prepare_to_wait_event+0x101/0x190\n  :\n[ 8569.952940] Call Trace:\n[ 8569.952941]  <TASK>\n[ 8569.952944]  ref_scale_reader+0x380/0x4a0 [refscale]\n[ 8569.952959]  kthread+0x10e/0x130\n[ 8569.952966]  ret_from_fork+0x1f/0x30\n[ 8569.952973]  </TASK>\n\nThe likely cause is that init_waitqueue_head() is called after the call to\nthe torture_create_kthread() function that creates the ref_scale_reader\nkthread.  Although this init_waitqueue_head() call will very likely\ncomplete before this kthread is created and starts running, it is\npossible that the calling kthread will be delayed between the calls to\ntorture_create_kthread() and init_waitqueue_head().  In this case, the\nnew kthread will use the waitqueue head before it is properly initialized,\nwhich is not good for the kernel's health and well-being.\n\nThe above crash happened here:\n\n\tstatic inline void __add_wait_queue(...)\n\t{\n\t\t:\n\t\tif (!(wq->flags & WQ_FLAG_PRIORITY)) <=== Crash here\n\nThe offset of flags from list_head entry in wait_queue_entry is\n-0x18. If reader_tasks[i].wq.head.next is NULL as allocated reader_task\nstructure is zero initialized, the instruction will try to access address\n0xffffffffffffffe8, which is exactly the fault address listed above.\n\nThis commit therefore invokes init_waitqueue_head() before creating\nthe kthread."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrefscale: Corrección del uso no inicializado de wait_queue_head_t\n\nEjecutar la prueba refscale ocasionalmente bloquea el kernel con el siguiente error:\n\n[ 8569.952896] BUG: no se puede manejar el fallo de página para la dirección: ffffffffffffffe8\n[ 8569.952900] #PF: acceso de lectura de supervisor en modo kernel\n[ 8569.952902] #PF: error_code(0x0000) - página no presente\n[ 8569.952904] PGD c4b048067 P4D c4b049067 PUD c4b04b067 PMD 0\n[ 8569.952910] Oops: 0000 [#1] PREEMPT_RT SMP NOPTI\n[ 8569.952916] Nombre del hardware: Dell Inc. PowerEdge R750/0WMWCR, BIOS 1.2.4 05/28/2021\n[ 8569.952917] RIP: 0010:prepare_to_wait_event+0x101/0x190\n  :\n[ 8569.952940] Traza de llamada:\n[ 8569.952941]  \n[ 8569.952944]  ref_scale_reader+0x380/0x4a0 [refscale]\n[ 8569.952959]  kthread+0x10e/0x130\n[ 8569.952966]  ret_from_fork+0x1f/0x30\n[ 8569.952973]  \n\nLa causa probable es que se llama a init_waitqueue_head() después de la llamada a la función torture_create_kthread() que crea el kthread ref_scale_reader. Aunque es muy probable que esta llamada a init_waitqueue_head() se complete antes de que este kthread sea creado y comience a ejecutarse, es posible que el kthread que realiza la llamada se retrase entre las llamadas a torture_create_kthread() e init_waitqueue_head(). En este caso, el nuevo kthread utilizará la cabecera de la cola de espera antes de que esté correctamente inicializada, lo cual no es bueno para la salud y el bienestar del kernel.\n\nEl bloqueo anterior ocurrió aquí:\n\n\tstatic inline void __add_wait_queue(...)\n\t{\n\t\t:\n\t\tif (!(wq-&gt;flags &amp; WQ_FLAG_PRIORITY)) &lt;=== Bloqueo aquí\n\nEl desplazamiento de flags desde la entrada list_head en wait_queue_entry es -0x18. Si reader_tasks[i].wq.head.next es NULL, ya que la estructura reader_task asignada se inicializa a cero, la instrucción intentará acceder a la dirección 0xffffffffffffffe8, que es exactamente la dirección de fallo mencionada anteriormente.\n\nEste commit, por lo tanto, invoca init_waitqueue_head() antes de crear el kthread."
    }
  ],
  "lastModified": "2026-06-17T06:47:12.823",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}