Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2023-53587— ring-buffer: Sync IRQ works before buffer destruction

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于销毁缓冲区前未同步IRQ工作，可能导致释放后重用。

CVSS 7.8 · High EPSS 0.15% · P5

Possible ATT&CK Techniques 1 AI

T1564 · Hide Artifacts

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 15693458c4bc0693fd63a50d60f35b628fcf4e29< 372c5ee537b8366b64b691ba29e9335525e1655e affected
15693458c4bc0693fd63a50d60f35b628fcf4e29< 2702b67f59d455072a08dc40312f9b090d4dec04 affected
15693458c4bc0693fd63a50d60f35b628fcf4e29< 2399b1fda025e939b6fb1ac94505bcf718534e65 affected
15693458c4bc0693fd63a50d60f35b628fcf4e29< 1c99f65d6af2a454bfd5207b4f6a97c8474a1191 affected
15693458c4bc0693fd63a50d60f35b628fcf4e29< c63741e872fcfb10e153517750f7908f0c00f60d affected
15693458c4bc0693fd63a50d60f35b628fcf4e29< d9834abd8b24d1fe8092859e436fe1e0fd467c61 affected
15693458c4bc0693fd63a50d60f35b628fcf4e29< fc6858b7f8e1221f62ce8c6ff8a13a349c32cd76 affected
15693458c4bc0693fd63a50d60f35b628fcf4e29< 0a65165bd24ee9231191597b7c232376fcd70cdb affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-53587

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ring-buffer: Sync IRQ works before buffer destruction
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but it did happen in ARCH=um with time-travel) to destroy the ringbuffer before the IRQ work ran, leading this KASAN report (or a crash without KASAN): BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a Read of size 8 at addr 000000006d640a48 by task swapper/0 CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7 Stack: 60c4f20f 0c203d48 41b58ab3 60f224fc 600477fa 60f35687 60c4f20f 601273dd 00000008 6101eb00 6101eab0 615be548 Call Trace: [<60047a58>] show_stack+0x25e/0x282 [<60c609e0>] dump_stack_lvl+0x96/0xfd [<60c50d4c>] print_report+0x1a7/0x5a8 [<603078d3>] kasan_report+0xc1/0xe9 [<60308950>] __asan_report_load8_noabort+0x1b/0x1d [<60232844>] irq_work_run_list+0x11a/0x13a [<602328b4>] irq_work_tick+0x24/0x34 [<6017f9dc>] update_process_times+0x162/0x196 [<6019f335>] tick_sched_handle+0x1a4/0x1c3 [<6019fd9e>] tick_sched_timer+0x79/0x10c [<601812b9>] __hrtimer_run_queues.constprop.0+0x425/0x695 [<60182913>] hrtimer_interrupt+0x16c/0x2c4 [<600486a3>] um_timer+0x164/0x183 [...] Allocated by task 411: save_stack_trace+0x99/0xb5 stack_trace_save+0x81/0x9b kasan_save_stack+0x2d/0x54 kasan_set_track+0x34/0x3e kasan_save_alloc_info+0x25/0x28 ____kasan_kmalloc+0x8b/0x97 __kasan_kmalloc+0x10/0x12 __kmalloc+0xb2/0xe8 load_elf_phdrs+0xee/0x182 [...] The buggy address belongs to the object at 000000006d640800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 584 bytes inside of freed 1024-byte region [000000006d640800, 000000006d640c00) Add the appropriate irq_work_sync() so the work finishes before the buffers are destroyed. Prior to the commit in the Fixes tag below, there was only a single global IRQ work, so this issue didn't exist.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于销毁缓冲区前未同步IRQ工作，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 15693458c4bc0693fd63a50d60f35b628fcf4e29 ~ 372c5ee537b8366b64b691ba29e9335525e1655e -
Linux Linux 3.10 -

II. Public POCs for CVE-2023-53587

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-53587

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-10-04 · 144 CVEs total

CVE-2025-39932 9.8 CRITICAL smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)
CVE-2025-39948 9.8 CRITICAL ice: fix Rx page leak on multi-buffer frames
CVE-2025-39946 9.8 CRITICAL tls: make sure to abort the stream if headers are bogus
CVE-2025-39933 9.4 CRITICAL smb: client: let recv_done verify data_offset, data_length and remaining_data_length
CVE-2025-39943 9.4 CRITICAL ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
CVE-2023-53600 9.1 CRITICAL tunnels: fix kasan splat when generating ipv4 pmtu error
CVE-2023-53615 8.8 HIGH scsi: qla2xxx: Fix deletion race condition
CVE-2025-39952 8.8 HIGH wifi: wilc1000: avoid buffer overflow in WID string configuration
CVE-2023-53589 8.8 HIGH wifi: iwlwifi: mvm: don't trust firmware n_channels
CVE-2023-53586 8.8 HIGH scsi: target: Fix multiple LUN_RESET handling
CVE-2022-50493 8.8 HIGH scsi: qla2xxx: Fix crash when I/O abort times out
CVE-2023-53598 8.4 HIGH bus: mhi: host: Range check CHDBOFF and ERDBOFF
CVE-2023-53560 7.8 HIGH tracing/histograms: Add histograms to hist_vars if they have referenced variables
CVE-2022-50492 7.8 HIGH drm/msm: fix use-after-free on probe deferral
CVE-2023-53559 7.8 HIGH ip_vti: fix potential slab-use-after-free in decode_session6
CVE-2023-53557 7.8 HIGH fprobe: Release rethook after the ftrace_ops is unregistered
CVE-2023-53556 7.8 HIGH iavf: Fix use-after-free in free_netdev
CVE-2023-53539 7.8 HIGH RDMA/rxe: Fix incomplete state save in rxe_requester
CVE-2023-53536 7.8 HIGH blk-crypto: make blk_crypto_evict_key() more robust
CVE-2023-53537 7.8 HIGH f2fs: fix to avoid use-after-free for cached IPU bio

Showing top 20 of 144 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2023-53587

No comments yet

Leave a comment