CVE-2023-53986— mips: bmips: BCM6358: disable RAC flush for TP1
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于BCM6358上从TP1启动时启用了RAC刷新，可能导致内核崩溃。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 14
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | d59098a0e9cb3c7767090e935c909b37a30629ab< d65de5ee8b72868fbbbd39ca73017d0e526fa13a |
affected |
d59098a0e9cb3c7767090e935c909b37a30629ab< 47a449ec09b4479b89dcc6b27ec3829fc82ffafb |
affected | ||
d59098a0e9cb3c7767090e935c909b37a30629ab< 65b723644294f1d79770704162c0e8d1f700b6f1 |
affected | ||
d59098a0e9cb3c7767090e935c909b37a30629ab< 2cdbcff99f15db86a10672fb220379a1ae46ccae |
affected | ||
d59098a0e9cb3c7767090e935c909b37a30629ab< 288c96aa5b5526cd4a946e84ef85e165857693b5 |
affected | ||
d59098a0e9cb3c7767090e935c909b37a30629ab< ab327f8acdf8d06601fbf058859a539a9422afff |
affected | ||
4.19 |
affected | ||
< 4.19 |
unaffected | ||
| … +6 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-53986
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mips: bmips: BCM6358: disable RAC flush for TP1
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
mips: bmips: BCM6358: disable RAC flush for TP1
RAC flush causes kernel panics on BCM6358 with EHCI/OHCI when booting from TP1:
[ 3.881739] usb 1-1: new high-speed USB device number 2 using ehci-platform
[ 3.895011] Reserved instruction in kernel code[#1]:
[ 3.900113] CPU: 0 PID: 1 Comm: init Not tainted 5.10.16 #0
[ 3.905829] $ 0 : 00000000 10008700 00000000 77d94060
[ 3.911238] $ 4 : 7fd1f088 00000000 81431cac 81431ca0
[ 3.916641] $ 8 : 00000000 ffffefff 8075cd34 00000000
[ 3.922043] $12 : 806f8d40 f3e812b7 00000000 000d9aaa
[ 3.927446] $16 : 7fd1f068 7fd1f080 7ff559b8 81428470
[ 3.932848] $20 : 00000000 00000000 55590000 77d70000
[ 3.938251] $24 : 00000018 00000010
[ 3.943655] $28 : 81430000 81431e60 81431f28 800157fc
[ 3.949058] Hi : 00000000
[ 3.952013] Lo : 00000000
[ 3.955019] epc : 80015808 setup_sigcontext+0x54/0x24c
[ 3.960464] ra : 800157fc setup_sigcontext+0x48/0x24c
[ 3.965913] Status: 10008703 KERNEL EXL IE
[ 3.970216] Cause : 00800028 (ExcCode 0a)
[ 3.974340] PrId : 0002a010 (Broadcom BMIPS4350)
[ 3.979170] Modules linked in: ohci_platform ohci_hcd fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug usbcore nls_base usb_common
[ 3.992907] Process init (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=77e22ec8)
[ 4.000776] Stack : 81431ef4 7fd1f080 81431f28 81428470 7fd1f068 81431edc 7ff559b8 81428470
[ 4.009467] 81431f28 7fd1f080 55590000 77d70000 77d5498c 80015c70 806f0000 8063ae74
[ 4.018149] 08100002 81431f28 0000000a 08100002 81431f28 0000000a 77d6b418 00000003
[ 4.026831] ffffffff 80016414 80080734 81431ecc 81431ecc 00000001 00000000 04000000
[ 4.035512] 77d54874 00000000 00000000 00000000 00000000 00000012 00000002 00000000
[ 4.044196] ...
[ 4.046706] Call Trace:
[ 4.049238] [<80015808>] setup_sigcontext+0x54/0x24c
[ 4.054356] [<80015c70>] setup_frame+0xdc/0x124
[ 4.059015] [<80016414>] do_notify_resume+0x1dc/0x288
[ 4.064207] [<80011b50>] work_notifysig+0x10/0x18
[ 4.069036]
[ 4.070538] Code: 8fc300b4 00001025 26240008 <ac820000> ac830004 3c048063 0c0228aa 24846a00 26240010
[ 4.080686]
[ 4.082517] ---[ end trace 22a8edb41f5f983b ]---
[ 4.087374] Kernel panic - not syncing: Fatal exception
[ 4.092753] Rebooting in 1 seconds..
Because the bootloader (CFE) is not initializing the Read-ahead cache properly
on the second thread (TP1). Since the RAC was not initialized properly, we
should avoid flushing it at the risk of corrupting the instruction stream as
seen in the trace above.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于BCM6358上从TP1启动时启用了RAC刷新，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-53986
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-53986
请登录查看更多情报信息。
Other References for CVE-2023-53986 (2)
Same Patch Batch · Linux · 2025-12-24 · 322 CVEs total
| CVE-2023-54076 | 9.8 CRITICAL | smb: client: fix missed ses refcounting |
| CVE-2022-50717 | 9.8 CRITICAL | nvmet-tcp: add bounds check on Transfer Tag |
| CVE-2025-68745 | 9.8 CRITICAL | scsi: qla2xxx: Clear cmds after chip reset |
| CVE-2025-68741 | 9.8 CRITICAL | scsi: qla2xxx: Fix improper freeing of purex item |
| CVE-2023-54090 | 9.8 CRITICAL | ixgbe: Fix panic during XDP_TX with > 64 CPUs |
| CVE-2023-54094 | 9.8 CRITICAL | net: prevent skb corruption on frag list segmentation |
| CVE-2023-53867 | 9.8 CRITICAL | ceph: fix potential use-after-free bug when trimming caps |
| CVE-2025-68359 | 9.8 CRITICAL | btrfs: fix double free of qgroup record after failure to add delayed ref head |
| CVE-2025-68726 | 9.8 CRITICAL | crypto: aead - Fix reqsize handling |
| CVE-2023-53996 | 9.3 CRITICAL | x86/sev: Make enc_dec_hypercall() accept a size instead of npages |
| CVE-2023-54071 | 8.8 HIGH | wifi: rtw88: use work to update rate to avoid RCU warning |
| CVE-2023-54060 | 8.8 HIGH | iommufd: Set end correctly when doing batch carry |
| CVE-2023-54043 | 8.8 HIGH | iommufd: Do not add the same hwpt to the ioas->hwpt_list twice |
| CVE-2022-50732 | 8.8 HIGH | staging: rtl8192u: Fix use after free in ieee80211_rx() |
| CVE-2025-68736 | 8.8 HIGH | landlock: Fix handling of disconnected directories |
| CVE-2023-54040 | 8.8 HIGH | ice: fix wrong fallback logic for FDIR |
| CVE-2023-54092 | 8.8 HIGH | KVM: s390: pv: fix index value of replaced ASCE |
| CVE-2023-54120 | 8.8 HIGH | Bluetooth: Fix race condition in hidp_session_thread |
| CVE-2022-50746 | 8.4 HIGH | erofs: validate the extent length for uncompressed pclusters |
| CVE-2025-68360 | 8.2 HIGH | wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks |
Showing top 20 of 322 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98385
sched/cache: Decouple sched_cache_group from mm to fix UAF -
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize
Same vendor: Linux
-
CVE-2026-98385
sched/cache: Decouple sched_cache_group from mm to fix UAF -
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize
V. Comments for CVE-2023-53986
No comments yet