CVE-2023-53281

published 2025-09-16

CVE-2023-53281: In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler() Commit 041879b12ddb…

Priority P4 19 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler()

Commit 041879b12ddb ("drivers: staging: rtl8192bs: Fix deadlock in
rtw_joinbss_event_prehandle()") besides fixing the deadlock also
modified _rtw_join_timeout_handler() to use spin_[un]lock_irq()
instead of spin_[un]lock_bh().

_rtw_join_timeout_handler() calls rtw_do_join() which takes
pmlmepriv->scanned_queue.lock using spin_[un]lock_bh(). This
spin_unlock_bh() call re-enables softirqs which triggers an oops in
kernel/softirq.c: __local_bh_enable_ip() when it calls
lockdep_assert_irqs_enabled():

[ 244.506087] WARNING: CPU: 2 PID: 0 at kernel/softirq.c:376 __local_bh_enable_ip+0xa6/0x100
...
[ 244.509022] Call Trace:
[ 244.509048]
[ 244.509100] _rtw_join_timeout_handler+0x134/0x170 [r8723bs]
[ 244.509468] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs]
[ 244.509772] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs]
[ 244.510076] call_timer_fn+0x95/0x2a0
[ 244.510200] __run_timers.part.0+0x1da/0x2d0

This oops is causd by the switch to spin_[un]lock_irq() which disables
the IRQs for the entire duration of _rtw_join_timeout_handler().

Disabling the IRQs is not necessary since all code taking this lock
runs from either user contexts or from softirqs, switch back to
spin_[un]lock_bh() to fix this.

Affected

20 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.37-1 (bookworm)	linux 6.1.37-1 (bookworm)
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc < 2a50e44a66d268ee5db3d177f1fdc1503dbce6e7	2a50e44a66d268ee5db3d177f1fdc1503dbce6e7
linux	linux	>= 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc < dc327e87c6d9bfd9ee08e76396b3c0ba848ec554	dc327e87c6d9bfd9ee08e76396b3c0ba848ec554
linux	linux	>= 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc < 4ab1bace1dd3875371b481ef4301c4671bddea22	4ab1bace1dd3875371b481ef4301c4671bddea22
linux	linux	>= 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc < 215792eda008f6a1e7ed9d77fa20d582d22bb114	215792eda008f6a1e7ed9d77fa20d582d22bb114
linux	linux	>= 5.15.47 < 5.15.111	5.15.111
linux	linux	>= 5.17.15 < 5.18	5.18
linux	linux	>= 5.18.4 < 5.19	5.19
linux	linux	>= ae60744d5fad840b9d056d35b4b652d95e755846 < 209850f17717a3b5cc558578bef5631ac7045539	209850f17717a3b5cc558578bef5631ac7045539
linux	linux_kernel	>= 0 < 6.1.37-1	6.1.37-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 5.15.47 < 5.15.111	5.15.111
linux	linux_kernel	>= 5.17.15 < 5.18	5.18
linux	linux_kernel	>= 5.18.4 < 6.1.28	6.1.28
linux	linux_kernel	>= 6.2 < 6.2.15	6.2.15
linux	linux_kernel	>= 6.3 < 6.3.2	6.3.2

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-667