{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-53668 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2023-53668 is a high-severity denial of service vulnerability in Linux kernel, published on 7 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-53668 and fix it if it is affected.\n\nWhat it is: CVE-2023-53668 is a high-severity denial of service vulnerability in Linux kernel, published on 7 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-53668 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-53668/ (Markdown: https://insights.sbomify.com/CVE-2023-53668/index.md)","id":"CVE-2023-53668","markdown":"https://insights.sbomify.com/CVE-2023-53668/index.md","name":"CVE-2023-53668","record":{"aliases":["BELL-CVE-2023-53668","DEBIAN-CVE-2023-53668","GHSA-r233-79v5-5734","UBUNTU-CVE-2023-53668"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A local attacker can cause a CPU soft lockup and system hang by reading the trace_pipe file due to an infinite loop in the ring buffer logic.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.1,"severity":"high","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-125","name":"Out-of-bounds Read"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix deadloop issue on reading trace_pipe\n\nSoft lockup occurs when reading file 'trace_pipe':\n\n  watchdog: BUG: soft lockup - CPU#6 stuck for 22s! [cat:4488]\n  [...]\n  RIP: 0010:ring_buffer_empty_cpu+0xed/0x170\n  RSP: 0018:ffff88810dd6fc48 EFLAGS: 00000246\n  RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff93d1aaeb\n  RDX: ffff88810a280040 RSI: 0000000000000008 RDI: ffff88811164b218\n  RBP: ffff88811164b218 R08: 0000000000000000 R09: ffff88815156600f\n  R10: ffffed102a2acc01 R11: 0000000000000001 R12: 0000000051651901\n  R13: 0000000000000000 R14: ffff888115e49500 R15: 0000000000000000\n  [...]\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f8d853c2000 CR3: 000000010dcd8000 CR4: 00000000000006e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   __find_next_entry+0x1a8/0x4b0\n   ? peek_next_entry+0x250/0x250\n   ? down_write+0xa5/0x120\n   ? down_write_killable+0x130/0x130\n   trace_find_next_entry_inc+0x3b/0x1d0\n   tracing_read_pipe+0x423/0xae0\n   ? tracing_splice_read_pipe+0xcb0/0xcb0\n   vfs_read+0x16b/0x490\n   ksys_read+0x105/0x210\n   ? __ia32_sys_pwrite64+0x200/0x200\n   ? switch_fpu_return+0x108/0x220\n   do_syscall_64+0x33/0x40\n   entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nThrough the vmcore, I found it's because in tracing_read_pipe(),\nring_buffer_empty_cpu() found some buffer is not empty but then it\ncannot read anything due to \"rb_num_of_entries() == 0\" always true,\nThen it infinitely loop the procedure due to user buffer not been\nfilled, see following code path:\n\n  tracing_read_pipe() {\n    ... ...\n    waitagain:\n      tracing_wait_pipe() // 1. find non-empty buffer here\n      trace_find_next_entry_inc()  // 2. loop here try to find an entry\n        __find_next_entry()\n          ring_buffer_empty_cpu();  // 3. find non-empty buffer\n          peek_next_entry()  // 4. but peek always return NULL\n            ring_buffer_peek()\n              rb_buffer_peek()\n                rb_get_reader_page()\n                  // 5. because rb_num_of_entries() == 0 always true here\n                  //    then return NULL\n      // 6. user buffer not been filled so goto 'waitgain'\n      //    and eventually leads to an deadloop in kernel!!!\n  }\n\nBy some analyzing, I found that when resetting ringbuffer, the 'entries'\nof its pages are not all cleared (see rb_reset_cpu()). Then when reducing\nthe ringbuffer, and if some reduced pages exist dirty 'entries' data, they\nwill be added into 'cpu_buffer-\u003eoverrun' (see rb_remove_pages()), which\ncause wrong 'overrun' count and eventually cause the deadloop issue.\n\nTo fix it, we need to clear every pages in rb_reset_cpu().","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ring-buffer: Fix deadloop issue on reading trace_pipe","id":"CVE-2023-53668","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2023"},"n_packages":0,"n_references":8,"next":{"headline":"tcp: fix skb_copy_ubufs() vs BIG TCP","id":"CVE-2023-53669"},"packages":[],"prev":{"headline":"net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize","id":"CVE-2023-53667"},"products":["Linux"],"published":"2025-10-07","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A local attacker can cause a CPU soft lockup and system hang by reading the trace_pipe file due to an infinite loop in the ring buffer logic.","url":"https://insights.sbomify.com/CVE-2023-53668/"}