CVE-2023-53624
published 2025-10-07CVE-2023-53624: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq: fix integer overflow of "credit" if sch_fq is configured with "initial…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.19%
9.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_fq: fix integer overflow of "credit"
if sch_fq is configured with "initial quantum" having values greater than
INT_MAX, the first assignment of "credit" does signed integer overflow to
a very negative value.
In this situation, the syzkaller script provided by Cristoph triggers the
CPU soft-lockup warning even with few sockets. It's not an infinite loop,
but "credit" wasn't probably meant to be minus 2Gb for each new flow.
Capping "initial quantum" to INT_MAX proved to fix the issue.
v2: validation of "initial quantum" is done in fq_policy, instead of open
coding in fq_change() _ suggested by Jakub Kicinski
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.37-1 (bookworm) | linux 6.1.37-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 4b8a05e3801661a0438fcd0cdef181030d966a5a | 4b8a05e3801661a0438fcd0cdef181030d966a5a |
| linux | linux | >= afe4fd062416b158a8a8538b23adc1930a9b88dc < d0b43125ec892aeb1b03e5df5aab595097da225a | d0b43125ec892aeb1b03e5df5aab595097da225a |
| linux | linux | >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 4fbefeab88c6e79753a25099d455d3d59d2946b4 | 4fbefeab88c6e79753a25099d455d3d59d2946b4 |
| linux | linux | >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 85f24cb2f10b2b0f2882e5786a09b4790bb3a0ad | 85f24cb2f10b2b0f2882e5786a09b4790bb3a0ad |
| linux | linux | >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 2322462d6f9ad4874f4e3c63df3b5cc00cb1acbd | 2322462d6f9ad4874f4e3c63df3b5cc00cb1acbd |
| linux | linux | >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 7041101ff6c3073fd8f2e99920f535b111c929cb | 7041101ff6c3073fd8f2e99920f535b111c929cb |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.37-1 | 6.1.37-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 3.12 < 5.10.180 | 5.10.180 |
| linux | linux_kernel | >= 5.11 < 5.15.111 | 5.15.111 |
| linux | linux_kernel | >= 5.16 < 6.1.28 | 6.1.28 |
| linux | linux_kernel | >= 6.2 < 6.2.15 | 6.2.15 |
| linux | linux_kernel | >= 6.3 < 6.3.2 | 6.3.2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.3.1 sched fq_change credit integer overflow (Nessus ID 276910 / WID-SEC-2025-2229)
vuldb·2026-04-20·CVSS 5.5
CVE-2023-53624 [MEDIUM] Linux Kernel up to 6.3.1 sched fq_change credit integer overflow (Nessus ID 276910 / WID-SEC-2025-2229)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 5.10.179/5.15.110/6.1.27/6.2.14/6.3.1. This impacts the function fq_change of the component sched. Executing a manipulation of the argument credit can lead to integer overflow.
This vulnerability is registered as CVE-2023-53624. The attack requires access to the local network. No exploit is available.
You should upgrade the affected component.
GHSA
GHSA-xhfr-4q2x-5mx4: In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_fq: fix integer overflow of "credit"
if sch_fq is configured with
ghsa_unreviewed·2025-10-07
CVE-2023-53624 [MEDIUM] CWE-190 GHSA-xhfr-4q2x-5mx4: In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_fq: fix integer overflow of "credit"
if sch_fq is configured with
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_fq: fix integer overflow of "credit"
if sch_fq is configured with "initial quantum" having values greater than
INT_MAX, the first assignment of "credit" does signed integer overflow to
a very negative value.
In this situation, the syzkaller script provided by Cristoph triggers the
CPU soft-lockup warning even with few sockets. It's not an infinite loop,
but "credit" wasn't probably meant to be minus 2Gb for each new flow.
Capping "initial quantum" to INT_MAX proved to fix the issue.
v2: validation of "initial quantum" is done in fq_policy, instead of open
coding in fq_change() _ suggested by Jakub Kicinski
OSV
CVE-2023-53624: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq: fix integer overflow of "credit" if sch_fq is configured with "
osv·2025-10-07·CVSS 5.5
CVE-2023-53624 [MEDIUM] CVE-2023-53624: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq: fix integer overflow of "credit" if sch_fq is configured with "
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq: fix integer overflow of "credit" if sch_fq is configured with "initial quantum" having values greater than INT_MAX, the first assignment of "credit" does signed integer overflow to a very negative value. In this situation, the syzkaller script provided by Cristoph triggers the CPU soft-lockup warning even with few sockets. It's not an infinite loop, but "credit" wasn't probably meant to be minus 2Gb for each new flow. Capping "initial quantum" to INT_MAX proved to fix the issue. v2: validation of "initial quantum" is done in fq_policy, instead of open coding in fq_change() _ suggested by Jakub Kicinski
Red Hat
kernel: net/sched: sch_fq: fix integer overflow of "credit"
vendor_redhat·2025-10-07·CVSS 5.5
CVE-2023-53624 [MEDIUM] kernel: net/sched: sch_fq: fix integer overflow of "credit"
kernel: net/sched: sch_fq: fix integer overflow of "credit"
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_fq: fix integer overflow of "credit"
if sch_fq is configured with "initial quantum" having values greater than
INT_MAX, the first assignment of "credit" does signed integer overflow to
a very negative value.
In this situation, the syzkaller script provided by Cristoph triggers the
CPU soft-lockup warning even with few sockets. It's not an infinite loop,
but "credit" wasn't probably meant to be minus 2Gb for each new flow.
Capping "initial quantum" to INT_MAX proved to fix the issue.
v2: validation of "initial quantum" is done in fq_policy, instead of open
coding in fq_change() _ suggested by Jakub Kicinski
An integer overflow flaw was found in the
Debian
CVE-2023-53624: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ...
vendor_debian·2023·CVSS 5.5
CVE-2023-53624 [MEDIUM] CVE-2023-53624: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ...
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq: fix integer overflow of "credit" if sch_fq is configured with "initial quantum" having values greater than INT_MAX, the first assignment of "credit" does signed integer overflow to a very negative value. In this situation, the syzkaller script provided by Cristoph triggers the CPU soft-lockup warning even with few sockets. It's not an infinite loop, but "credit" wasn't probably meant to be minus 2Gb for each new flow. Capping "initial quantum" to INT_MAX proved to fix the issue. v2: validation of "initial quantum" is done in fq_policy, instead of open coding in fq_change() _ suggested by Jakub Kicinski
Scope: local
bookworm: resolved (fixed in 6.1.37-1)
bullseye: resolved (fixed in 5.10.191-1)
forky: res
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2322462d6f9ad4874f4e3c63df3b5cc00cb1acbdhttps://git.kernel.org/stable/c/4b8a05e3801661a0438fcd0cdef181030d966a5ahttps://git.kernel.org/stable/c/4fbefeab88c6e79753a25099d455d3d59d2946b4https://git.kernel.org/stable/c/7041101ff6c3073fd8f2e99920f535b111c929cbhttps://git.kernel.org/stable/c/85f24cb2f10b2b0f2882e5786a09b4790bb3a0adhttps://git.kernel.org/stable/c/d0b43125ec892aeb1b03e5df5aab595097da225a
2025-10-07
Published