CVE-2023-53712 ARM: 9317/1: kexec: Make smp stop calls asynchronous
A local attacker can trigger a kernel panic via hrtimer interrupts, causing a denial of service on ARM Linux systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53712?
CVE-2023-53712 is a denial of service vulnerability in Linux, published on 22 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ARM: 9317/1: kexec: Make smp stop calls asynchronous
If a panic is triggered by a hrtimer interrupt all online cpus will be notified and set offline. But as highlighted by commit 19dbdcb8039c ("smp: Warn on function calls from softirq context") this call should not be made synchronous with disabled interrupts:
softdog: Initiating panic Kernel panic - not syncing: Software Watchdog Timer expired WARNING: CPU: 1 PID: 0 at kernel/smp.c:753 smp_call_function_many_cond unwind_backtrace: show_stack dump_stack_lvl __warn warn_slowpath_fmt smp_call_function_many_cond smp_call_function crash_smp_send_stop.part.0 machine_crash_shutdown __crash_kexec panic softdog_fire __hrtimer_run_queues hrtimer_interrupt
Make the smp call for machine_crash_nonpanic_core() asynchronous.
Which versions are affected by CVE-2023-53712?
How do I fix CVE-2023-53712?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-53712 being exploited?
There is no known exploitation of CVE-2023-53712 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-53712, DEBIAN-CVE-2023-53712, GHSA-m7qp-wfxw-cjvm, ROOT-OS-DEBIAN-11-CVE-2023-53712, UBUNTU-CVE-2023-53712.