CVE-2023-52942 cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()
A logic error in the Linux kernel's cgroup cpuset subsystem allows a local attacker to trigger a system panic by misconfiguring CPU partitions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52942?
CVE-2023-52942 is a medium-severity denial of service vulnerability in Linux kernel, published on 27 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()
It was found that the check to see if a partition could use up all the cpus from the parent cpuset in update_parent_subparts_cpumask() was incorrect. As a result, it is possible to leave parent with no effective cpu left even if there are tasks in the parent cpuset. This can lead to system panic as reported in [1].
Fix this probem by updating the check to fail the enabling the partition if parent's effective_cpus is a subset of the child's cpus_allowed.
Also record the error code when an error happens in update_prstate() and add a test case where parent partition and child have the same cpu list and parent has task. Enabling partition in the child will fail in this case.
[1] https://www.spinics.net/lists/cgroups/msg36254.html
Which versions are affected by CVE-2023-52942?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52942?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-52942 being exploited?
There is no known exploitation of CVE-2023-52942 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52942, DEBIAN-CVE-2023-52942, GHSA-5w7q-3v7j-8q5q, UBUNTU-CVE-2023-52942.