CVE-2023-53216 in Linux
Summary
by MITRE • 09/15/2025
In the Linux kernel, the following vulnerability has been resolved:
arm64: efi: Make efi_rt_lock a raw_spinlock
Running a rt-kernel base on 6.2.0-rc3-rt1 on an Ampere Altra outputs the following: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 9, name: kworker/u320:0 preempt_count: 2, expected: 0 RCU nest depth: 0, expected: 0 3 locks held by kworker/u320:0/9: #0: ffff3fff8c27d128 ((wq_completion)efi_rts_wq){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41)
#1: ffff80000861bdd0 ((work_completion)(&efi_rts_work.work)){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41)
#2: ffffdf7e1ed3e460 (efi_rt_lock){+.+.}-{3:3}, at: efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101)
Preemption disabled at: efi_virtmap_load (./arch/arm64/include/asm/mmu_context.h:248) CPU: 0 PID: 9 Comm: kworker/u320:0 Tainted: G W 6.2.0-rc3-rt1 Hardware name: WIWYNN Mt.Jade Server System B81.03001.0005/Mt.Jade Motherboard, BIOS 1.08.20220218 (SCP: 1.08.20220218) 2022/02/18 Workqueue: efi_rts_wq efi_call_rts Call trace: dump_backtrace (arch/arm64/kernel/stacktrace.c:158) show_stack (arch/arm64/kernel/stacktrace.c:165) dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) dump_stack (lib/dump_stack.c:114) __might_resched (kernel/sched/core.c:10134) rt_spin_lock (kernel/locking/rtmutex.c:1769 (discriminator 4)) efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101) [...]
This seems to come from commit ff7a167961d1 ("arm64: efi: Execute runtime services from a dedicated stack") which adds a spinlock. This spinlock is taken through: efi_call_rts() \-efi_call_virt() \-efi_call_virt_pointer() \-arch_efi_call_virt_setup()
Make 'efi_rt_lock' a raw_spinlock to avoid being preempted.
[ardb: The EFI runtime services are called with a different set of
translation tables, and are permitted to use the SIMD registers. The context switch code preserves/restores neither, and so EFI calls must be made with preemption disabled, rather than only disabling migration.]
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/10/2026
The vulnerability described in CVE-2023-53216 affects the Linux kernel's implementation of EFI runtime services on arm64 architectures. This issue manifests as a kernel bug where a sleeping function is invoked from an invalid context, specifically within the efi_rt_lock spinlock implementation. The problem occurs when running a real-time kernel based on version 6.2.0-rc3-rt1 on Ampere Altra hardware, indicating a critical failure in the kernel's locking mechanisms during EFI runtime service execution. The kernel reports that the function is called with preemption disabled but the context suggests it should be able to sleep, creating an inconsistent state that violates kernel safety assumptions.
The technical flaw stems from the improper use of a spinlock type within the EFI runtime services framework. The original implementation uses a regular spinlock instead of a raw_spinlock, which causes issues when the system attempts to execute EFI runtime services from a dedicated stack context. The commit ff7a167961d1 introduced this spinlock but failed to account for the specific requirements of EFI runtime services execution. These services require execution with preemption disabled and must operate under special memory translation contexts, making them incompatible with standard spinlock behavior that can lead to sleep operations and context switching issues. The lock is taken through a call chain involving efi_call_rts, efi_call_virt, and arch_efi_call_virt_setup functions, which creates a situation where a non-raw spinlock cannot properly maintain the required execution context.
The operational impact of this vulnerability is severe as it can cause system instability, kernel panics, and complete system crashes on affected arm64 systems. The issue particularly affects real-time kernel configurations running on Ampere Altra hardware, where the kernel's locking subsystem fails to properly handle the EFI runtime service execution context. The error message indicates that the kworker thread attempting to execute EFI runtime services is in an invalid context where sleeping functions are not permitted, yet the current implementation attempts to use a spinlock that can potentially cause such situations. This vulnerability directly violates the kernel's locking rules and can lead to system hangs or unpredictable behavior during EFI runtime service operations.
The recommended mitigation involves changing the efi_rt_lock from a regular spinlock to a raw_spinlock to prevent the kernel from attempting to sleep during EFI runtime service execution. This approach aligns with the ARM64 architecture's specific requirements for EFI runtime services, which must execute with preemption disabled and require special handling of memory translation tables and SIMD registers. According to CWE-367, this represents a Time-of-Check to Time-of-Use vulnerability where the lock implementation fails to maintain proper execution context, and the ATT&CK framework's T1499.004 technique applies to system stability and availability impacts. The solution ensures that the EFI runtime services execute within the correct context without risking sleep operations that would violate the kernel's real-time constraints and architectural requirements for arm64 systems.