CVE-2023-53587
published 2025-10-04CVE-2023-53587: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction If something was written to the…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.15%
5.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Sync IRQ works before buffer destruction
If something was written to the buffer just before destruction,
it may be possible (maybe not in a real system, but it did
happen in ARCH=um with time-travel) to destroy the ringbuffer
before the IRQ work ran, leading this KASAN report (or a crash
without KASAN):
BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a
Read of size 8 at addr 000000006d640a48 by task swapper/0
CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7
Stack:
60c4f20f 0c203d48 41b58ab3 60f224fc
600477fa 60f35687 60c4f20f 601273dd
00000008 6101eb00 6101eab0 615be548
Call Trace:
[] show_stack+0x25e/0x282
[] dump_stack_lvl+0x96/0xfd
[] print_report+0x1a7/0x5a8
[] kasan_report+0xc1/0xe9
[] __asan_report_load8_noabort+0x1b/0x1d
[] irq_work_run_list+0x11a/0x13a
[] irq_work_tick+0x24/0x34
[] update_process_times+0x162/0x196
[] tick_sched_handle+0x1a4/0x1c3
[] tick_sched_timer+0x79/0x10c
[] __hrtimer_run_queues.constprop.0+0x425/0x695
[] hrtimer_interrupt+0x16c/0x2c4
[] um_timer+0x164/0x183
[...]
Allocated by task 411:
save_stack_trace+0x99/0xb5
stack_trace_save+0x81/0x9b
kasan_save_stack+0x2d/0x54
kasan_set_track+0x34/0x3e
kasan_save_alloc_info+0x25/0x28
____kasan_kmalloc+0x8b/0x97
__kasan_kmalloc+0x10/0x12
__kmalloc+0xb2/0xe8
load_elf_phdrs+0xee/0x182
[...]
The buggy address belongs to the object at 000000006d640800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 584 bytes inside of
freed 1024-byte region [000000006d640800, 000000006d640c00)
Add the appropriate irq_work_sync() so the work finishes before
the buffers are destroyed.
Prior to the commit in the Fixes tag below, there was only a
single global IRQ work, so this issue didn't exist.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.37-1 (bookworm) | linux 6.1.37-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 372c5ee537b8366b64b691ba29e9335525e1655e | 372c5ee537b8366b64b691ba29e9335525e1655e |
| linux | linux | >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 2702b67f59d455072a08dc40312f9b090d4dec04 | 2702b67f59d455072a08dc40312f9b090d4dec04 |
| linux | linux | >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 2399b1fda025e939b6fb1ac94505bcf718534e65 | 2399b1fda025e939b6fb1ac94505bcf718534e65 |
| linux | linux | >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 1c99f65d6af2a454bfd5207b4f6a97c8474a1191 | 1c99f65d6af2a454bfd5207b4f6a97c8474a1191 |
| linux | linux | >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < c63741e872fcfb10e153517750f7908f0c00f60d | c63741e872fcfb10e153517750f7908f0c00f60d |
| linux | linux | >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < d9834abd8b24d1fe8092859e436fe1e0fd467c61 | d9834abd8b24d1fe8092859e436fe1e0fd467c61 |
| linux | linux | >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < fc6858b7f8e1221f62ce8c6ff8a13a349c32cd76 | fc6858b7f8e1221f62ce8c6ff8a13a349c32cd76 |
| linux | linux | >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 0a65165bd24ee9231191597b7c232376fcd70cdb | 0a65165bd24ee9231191597b7c232376fcd70cdb |
| linux | linux | >= 15693458c4bc0693fd63a50d60f35b628fcf4e29 < 675751bb20634f981498c7d66161584080cc061e | 675751bb20634f981498c7d66161584080cc061e |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.37-1 | 6.1.37-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 3.10 < 4.14.315 | 4.14.315 |
| linux | linux_kernel | >= 4.15 < 4.19.283 | 4.19.283 |
| linux | linux_kernel | >= 4.20 < 5.4.243 | 5.4.243 |
| linux | linux_kernel | >= 5.11 < 5.15.111 | 5.15.111 |
| linux | linux_kernel | >= 5.16 < 6.1.28 | 6.1.28 |
| linux | linux_kernel | >= 5.5 < 5.10.180 | 5.10.180 |
| linux | linux_kernel | >= 6.2 < 6.2.15 | 6.2.15 |
| linux | linux_kernel | >= 6.3 < 6.3.2 | 6.3.2 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-53587: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction If something was written to
osv·2025-10-04·CVSS 7.8
CVE-2023-53587 [HIGH] CVE-2023-53587: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction If something was written to
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but it did happen in ARCH=um with time-travel) to destroy the ringbuffer before the IRQ work ran, leading this KASAN report (or a crash without KASAN): BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a Read of size 8 at addr 000000006d640a48 by task swapper/0 CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7 Stack: 60c4f20f 0c203d48 41b58ab3 60f224fc 600477fa 60f35687 60c4f20f 601273dd 00000008 6101eb00 6101eab0 615be548 Call Trace: [] show_stack+0x25e/0x282 [] dump_stack_lvl+0x96/0xfd [] print_report+0x1a7/0x5a8 [] kasan_report+0xc1/0xe9
GHSA
GHSA-7wv9-8c5x-6hmc: In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Sync IRQ works before buffer destruction
If something was written t
ghsa_unreviewed·2025-10-04
CVE-2023-53587 [HIGH] CWE-416 GHSA-7wv9-8c5x-6hmc: In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Sync IRQ works before buffer destruction
If something was written t
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Sync IRQ works before buffer destruction
If something was written to the buffer just before destruction,
it may be possible (maybe not in a real system, but it did
happen in ARCH=um with time-travel) to destroy the ringbuffer
before the IRQ work ran, leading this KASAN report (or a crash
without KASAN):
BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a
Read of size 8 at addr 000000006d640a48 by task swapper/0
CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7
Stack:
60c4f20f 0c203d48 41b58ab3 60f224fc
600477fa 60f35687 60c4f20f 601273dd
00000008 6101eb00 6101eab0 615be548
Call Trace:
[] show_stack+0x25e/0x282
[] dump_stack_lvl+0x96/0xfd
[] print_report+0x1a7/0x5a8
[] kasan_report+0xc1/0
Red Hat
kernel: ring-buffer: Sync IRQ works before buffer destruction
vendor_redhat·2025-10-04·CVSS 7.8
CVE-2023-53587 [HIGH] CWE-667 kernel: ring-buffer: Sync IRQ works before buffer destruction
kernel: ring-buffer: Sync IRQ works before buffer destruction
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Sync IRQ works before buffer destruction
If something was written to the buffer just before destruction,
it may be possible (maybe not in a real system, but it did
happen in ARCH=um with time-travel) to destroy the ringbuffer
before the IRQ work ran, leading this KASAN report (or a crash
without KASAN):
BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a
Read of size 8 at addr 000000006d640a48 by task swapper/0
CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7
Stack:
60c4f20f 0c203d48 41b58ab3 60f224fc
600477fa 60f35687 60c4f20f 601273dd
00000008 6101eb00 6101eab0 615be548
Call Trace:
[] show_stack+0x25e/0x282
[] dump_stack_lvl+0
Debian
CVE-2023-53587: linux - In the Linux kernel, the following vulnerability has been resolved: ring-buffer...
vendor_debian·2023·CVSS 7.8
CVE-2023-53587 [HIGH] CVE-2023-53587: linux - In the Linux kernel, the following vulnerability has been resolved: ring-buffer...
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but it did happen in ARCH=um with time-travel) to destroy the ringbuffer before the IRQ work ran, leading this KASAN report (or a crash without KASAN): BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a Read of size 8 at addr 000000006d640a48 by task swapper/0 CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7 Stack: 60c4f20f 0c203d48 41b58ab3 60f224fc 600477fa 60f35687 60c4f20f 601273dd 00000008 6101eb00 6101eab0 615be548 Call Trace: [] show_stack+0x25e/0x282 [] dump_stack_lvl+0x96/0xfd [] print_report+0x1a7/0x5a8 [] kasan_report+0xc1/0xe9
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0a65165bd24ee9231191597b7c232376fcd70cdbhttps://git.kernel.org/stable/c/1c99f65d6af2a454bfd5207b4f6a97c8474a1191https://git.kernel.org/stable/c/2399b1fda025e939b6fb1ac94505bcf718534e65https://git.kernel.org/stable/c/2702b67f59d455072a08dc40312f9b090d4dec04https://git.kernel.org/stable/c/372c5ee537b8366b64b691ba29e9335525e1655ehttps://git.kernel.org/stable/c/675751bb20634f981498c7d66161584080cc061ehttps://git.kernel.org/stable/c/c63741e872fcfb10e153517750f7908f0c00f60dhttps://git.kernel.org/stable/c/d9834abd8b24d1fe8092859e436fe1e0fd467c61https://git.kernel.org/stable/c/fc6858b7f8e1221f62ce8c6ff8a13a349c32cd76
2025-10-04
Published