CVE-2023-53815 posix-timers: Prevent RT livelock in itimer_delete()
A local attacker can cause a livelock in the Linux kernel's posix timer deletion, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53815?
CVE-2023-53815 is a denial of service vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
posix-timers: Prevent RT livelock in itimer_delete()
itimer_delete() has a retry loop when the timer is concurrently expired. On non-RT kernels this just spin-waits until the timer callback has completed, except for posix CPU timers which have HAVE_POSIX_CPU_TIMERS_TASK_WORK enabled.
In that case and on RT kernels the existing task could live lock when preempting the task which does the timer delivery.
Replace spin_unlock() with an invocation of timer_wait_running() to handle it the same way as the other retry loops in the posix timer code.
Which versions are affected by CVE-2023-53815?
How do I fix CVE-2023-53815?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-53815 being exploited?
There is no known exploitation of CVE-2023-53815 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-53815, DEBIAN-CVE-2023-53815, GHSA-qppf-xpg3-fxjq, UBUNTU-CVE-2023-53815.