CVE-2023-53623
published 2025-10-07CVE-2023-53623: In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() The si->lock must…
PriorityP417medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.13%
2.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
The si->lock must be held when deleting the si from the available list.
Otherwise, another thread can re-add the si to the available list, which
can lead to memory corruption. The only place we have found where this
happens is in the swapoff path. This case can be described as below:
core 0 core 1
swapoff
del_from_avail_list(si) waiting
try lock si->lock acquire swap_avail_lock
and re-add si into
swap_avail_head
acquire si->lock but missing si already being added again, and continuing
to clear SWP_WRITEOK, etc.
It can be easily found that a massive warning messages can be triggered
inside get_swap_pages() by some special cases, for example, we call
madvise(MADV_PAGEOUT) on blocks of touched memory concurrently, meanwhile,
run much swapon-swapoff operations (e.g. stress-ng-swap).
However, in the worst case, panic can be caused by the above scene. In
swapoff(), the memory used by si could be kept in swap_info[] after
turning off a swap. This means memory corruption will not be caused
immediately until allocated and reset for a new swap in the swapon path.
A panic message caused: (with CONFIG_PLIST_DEBUG enabled)
------------[ cut here ]------------
top: 00000000e58a3003, n: 0000000013e75cda, p: 000000008cd4451a
prev: 0000000035b1e58a, n: 000000008cd4451a, p: 000000002150ee8d
next: 000000008cd4451a, n: 000000008cd4451a, p: 000000008cd4451a
WARNING: CPU: 21 PID: 1843 at lib/plist.c:60 plist_check_prev_next_node+0x50/0x70
Modules linked in: rfkill(E) crct10dif_ce(E)...
CPU: 21 PID: 1843 Comm: stress-ng Kdump: ... 5.10.134+
Hardware name: Alibaba Cloud ECS, BIOS 0.0.0 02/06/2015
pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
pc : plist_check_prev_next_node+0x50/0x70
lr : plist_check_prev_next_node+0x50/0x70
sp : ffff0018009d3c30
x29: ffff0018009d3c40 x28: ffff800011b32a98
x27: 0000000000000000 x26: ffff001803908000
x25:
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.25-1 (bookworm) | linux 6.1.25-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= a2468cc9bfdff6139f59ca896671e5819ff5f94a < 111a79d9b92f0a679fe300ccd3119ae9741f3d54 | 111a79d9b92f0a679fe300ccd3119ae9741f3d54 |
| linux | linux | >= a2468cc9bfdff6139f59ca896671e5819ff5f94a < a55f268abdb74ac5633b75a09fefb58458e9d2a2 | a55f268abdb74ac5633b75a09fefb58458e9d2a2 |
| linux | linux | >= a2468cc9bfdff6139f59ca896671e5819ff5f94a < e7bba7ddb4318d5ea939c8db747c2c2780ab66f4 | e7bba7ddb4318d5ea939c8db747c2c2780ab66f4 |
| linux | linux | >= a2468cc9bfdff6139f59ca896671e5819ff5f94a < ea8c42b3b6d95ced3a4f555f04686d00ef0bb206 | ea8c42b3b6d95ced3a4f555f04686d00ef0bb206 |
| linux | linux | >= a2468cc9bfdff6139f59ca896671e5819ff5f94a < 4bdf1514b4268d29360ba9e43becdd49955bc7ae | 4bdf1514b4268d29360ba9e43becdd49955bc7ae |
| linux | linux | >= a2468cc9bfdff6139f59ca896671e5819ff5f94a < 85cc118ce6f1a627901b6db50c9d01f2ad78cdbf | 85cc118ce6f1a627901b6db50c9d01f2ad78cdbf |
| linux | linux | >= a2468cc9bfdff6139f59ca896671e5819ff5f94a < b9927d3a60ca9ed35625470888629c074e687ba0 | b9927d3a60ca9ed35625470888629c074e687ba0 |
| linux | linux | >= a2468cc9bfdff6139f59ca896671e5819ff5f94a < 6fe7d6b992113719e96744d974212df3fcddc76c | 6fe7d6b992113719e96744d974212df3fcddc76c |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 4.14 < 4.14.313 | 4.14.313 |
| linux | linux_kernel | >= 4.15 < 4.19.281 | 4.19.281 |
| linux | linux_kernel | >= 4.20 < 5.4.241 | 5.4.241 |
| linux | linux_kernel | >= 5.11 < 5.15.107 | 5.15.107 |
| linux | linux_kernel | >= 5.16 < 6.1.24 | 6.1.24 |
| linux | linux_kernel | >= 5.5 < 5.10.178 | 5.10.178 |
| linux | linux_kernel | >= 6.2 < 6.2.11 | 6.2.11 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.2.10 lib/plist.c get_swap_pages swap_info[] memory corruption (Nessus ID 284758 / WID-SEC-2025-2229)
vuldb·2026-04-20·CVSS 4.7
CVE-2023-53623 [MEDIUM] Linux Kernel up to 6.2.10 lib/plist.c get_swap_pages swap_info[] memory corruption (Nessus ID 284758 / WID-SEC-2025-2229)
A vulnerability has been found in Linux Kernel up to 6.2.10 and classified as critical. The impacted element is the function get_swap_pages in the library lib/plist.c. Performing a manipulation of the argument swap_info[] results in memory corruption.
This vulnerability is reported as CVE-2023-53623. The attacker must have access to the local network to execute the attack. No exploit exists.
The affected component should be upgraded.
OSV
CVE-2023-53623: In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() The si->lo
osv·2025-10-07·CVSS 4.7
CVE-2023-53623 [MEDIUM] CVE-2023-53623: In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() The si->lo
In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() The si->lock must be held when deleting the si from the available list. Otherwise, another thread can re-add the si to the available list, which can lead to memory corruption. The only place we have found where this happens is in the swapoff path. This case can be described as below: core 0 core 1 swapoff del_from_avail_list(si) waiting try lock si->lock acquire swap_avail_lock and re-add si into swap_avail_head acquire si->lock but missing si already being added again, and continuing to clear SWP_WRITEOK, etc. It can be easily found that a massive warning messages can be triggered inside get_swap_pages() by some special cases, for example, we call mad
GHSA
GHSA-2qcj-hqq8-v6f6: In the Linux kernel, the following vulnerability has been resolved:
mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
The si->
ghsa_unreviewed·2025-10-07
CVE-2023-53623 [MEDIUM] CWE-362 GHSA-2qcj-hqq8-v6f6: In the Linux kernel, the following vulnerability has been resolved:
mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
The si->
In the Linux kernel, the following vulnerability has been resolved:
mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
The si->lock must be held when deleting the si from the available list.
Otherwise, another thread can re-add the si to the available list, which
can lead to memory corruption. The only place we have found where this
happens is in the swapoff path. This case can be described as below:
core 0 core 1
swapoff
del_from_avail_list(si) waiting
try lock si->lock acquire swap_avail_lock
and re-add si into
swap_avail_head
acquire si->lock but missing si already being added again, and continuing
to clear SWP_WRITEOK, etc.
It can be easily found that a massive warning messages can be triggered
inside get_swap_pages() by some special cases, for example, we c
Red Hat
kernel: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
vendor_redhat·2025-10-07·CVSS 4.7
CVE-2023-53623 [MEDIUM] CWE-413 kernel: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
kernel: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
In the Linux kernel, the following vulnerability has been resolved:
mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
The si->lock must be held when deleting the si from the available list.
Otherwise, another thread can re-add the si to the available list, which
can lead to memory corruption. The only place we have found where this
happens is in the swapoff path. This case can be described as below:
core 0 core 1
swapoff
del_from_avail_list(si) waiting
try lock si->lock acquire swap_avail_lock
and re-add si into
swap_avail_head
acquire si->lock but missing si already being added again, and continuing
to clear SWP_WRITEOK, etc.
It can be easily found that a massive warning messages can be
Debian
CVE-2023-53623: linux - In the Linux kernel, the following vulnerability has been resolved: mm/swap: fi...
vendor_debian·2023·CVSS 4.7
CVE-2023-53623 [MEDIUM] CVE-2023-53623: linux - In the Linux kernel, the following vulnerability has been resolved: mm/swap: fi...
In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() The si->lock must be held when deleting the si from the available list. Otherwise, another thread can re-add the si to the available list, which can lead to memory corruption. The only place we have found where this happens is in the swapoff path. This case can be described as below: core 0 core 1 swapoff del_from_avail_list(si) waiting try lock si->lock acquire swap_avail_lock and re-add si into swap_avail_head acquire si->lock but missing si already being added again, and continuing to clear SWP_WRITEOK, etc. It can be easily found that a massive warning messages can be triggered inside get_swap_pages() by some special cases, for example, we call mad
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/111a79d9b92f0a679fe300ccd3119ae9741f3d54https://git.kernel.org/stable/c/4bdf1514b4268d29360ba9e43becdd49955bc7aehttps://git.kernel.org/stable/c/6fe7d6b992113719e96744d974212df3fcddc76chttps://git.kernel.org/stable/c/85cc118ce6f1a627901b6db50c9d01f2ad78cdbfhttps://git.kernel.org/stable/c/a55f268abdb74ac5633b75a09fefb58458e9d2a2https://git.kernel.org/stable/c/b9927d3a60ca9ed35625470888629c074e687ba0https://git.kernel.org/stable/c/e7bba7ddb4318d5ea939c8db747c2c2780ab66f4https://git.kernel.org/stable/c/ea8c42b3b6d95ced3a4f555f04686d00ef0bb206
2025-10-07
Published