CVE-2023-53668 in Linux
Summary
by MITRE • 10/07/2025
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix deadloop issue on reading trace_pipe
Soft lockup occurs when reading file 'trace_pipe':
watchdog: BUG: soft lockup - CPU#6 stuck for 22s! [cat:4488]
[...]
RIP: 0010:ring_buffer_empty_cpu+0xed/0x170 RSP: 0018:ffff88810dd6fc48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff93d1aaeb RDX: ffff88810a280040 RSI: 0000000000000008 RDI: ffff88811164b218 RBP: ffff88811164b218 R08: 0000000000000000 R09: ffff88815156600f R10: ffffed102a2acc01 R11: 0000000000000001 R12: 0000000051651901 R13: 0000000000000000 R14: ffff888115e49500 R15: 0000000000000000 [...]
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8d853c2000 CR3: 000000010dcd8000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __find_next_entry+0x1a8/0x4b0 ? peek_next_entry+0x250/0x250 ? down_write+0xa5/0x120 ? down_write_killable+0x130/0x130 trace_find_next_entry_inc+0x3b/0x1d0 tracing_read_pipe+0x423/0xae0 ? tracing_splice_read_pipe+0xcb0/0xcb0 vfs_read+0x16b/0x490 ksys_read+0x105/0x210 ? __ia32_sys_pwrite64+0x200/0x200 ? switch_fpu_return+0x108/0x220 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6
Through the vmcore, I found it's because in tracing_read_pipe(), ring_buffer_empty_cpu() found some buffer is not empty but then it cannot read anything due to "rb_num_of_entries() == 0" always true, Then it infinitely loop the procedure due to user buffer not been filled, see following code path:
tracing_read_pipe() {
... ... waitagain: tracing_wait_pipe() // 1. find non-empty buffer here trace_find_next_entry_inc() // 2. loop here try to find an entry __find_next_entry() ring_buffer_empty_cpu(); // 3. find non-empty buffer peek_next_entry() // 4. but peek always return NULL ring_buffer_peek() rb_buffer_peek() rb_get_reader_page() // 5. because rb_num_of_entries() == 0 always true here // then return NULL // 6. user buffer not been filled so goto 'waitgain' // and eventually leads to an deadloop in kernel!!! }
By some analyzing, I found that when resetting ringbuffer, the 'entries' of its pages are not all cleared (see rb_reset_cpu()). Then when reducing the ringbuffer, and if some reduced pages exist dirty 'entries' data, they will be added into 'cpu_buffer->overrun' (see rb_remove_pages()), which cause wrong 'overrun' count and eventually cause the deadloop issue.
To fix it, we need to clear every pages in rb_reset_cpu().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 03/01/2026
The vulnerability described in CVE-2023-53668 represents a critical soft lockup condition within the Linux kernel's tracing subsystem, specifically affecting the ring buffer implementation used for trace_pipe operations. This issue manifests as an infinite loop during the reading process of the trace_pipe file, which can lead to system unresponsiveness and denial of service. The root cause lies in the improper handling of ring buffer state management during buffer reset operations, creating a scenario where the kernel becomes stuck in a continuous loop attempting to read from a buffer that appears non-empty but contains no actual entries. The technical flaw occurs when ring_buffer_empty_cpu() incorrectly identifies buffer content as non-empty while simultaneously rb_num_of_entries() returns zero, leading to an endless retry mechanism that consumes CPU cycles indefinitely. This vulnerability directly impacts the kernel's ability to process trace data and can be exploited to cause system instability or complete system lockup.
The operational impact of this vulnerability extends beyond simple system performance degradation to potentially complete system compromise through denial of service attacks. When an attacker or malicious process continuously reads from trace_pipe, they can trigger the soft lockup condition that prevents the system from processing other critical operations. The affected code path demonstrates a classic race condition and state management error where the kernel's buffer management logic fails to properly synchronize the state of buffer entries with their actual content. The vulnerability specifically affects the tracing_read_pipe() function which is part of the kernel's trace event subsystem, making it particularly dangerous in environments where kernel tracing is actively used for debugging or monitoring purposes. The issue is exacerbated by the fact that the ring buffer reset operation does not properly clear all pages, leaving stale data that interferes with subsequent buffer operations and creates inconsistent buffer state information.
The fix for CVE-2023-53668 requires modifications to the ring buffer reset functionality to ensure complete clearing of all pages during the rb_reset_cpu() operation. This approach addresses the underlying cause by preventing the accumulation of stale entries that lead to the inconsistent buffer state described in the vulnerability report. The solution involves ensuring that when ring buffers are reset, all memory pages within the buffer are properly cleared to eliminate any residual data that could cause the buffer state to appear inconsistent. This fix aligns with security best practices for kernel memory management and demonstrates the importance of proper state synchronization in kernel subsystems. The vulnerability is classified as a software fault in kernel memory management and can be associated with CWE-691, which covers inadequate protection of code against code injection or improper handling of memory structures. The issue also relates to ATT&CK technique T1499.001 which involves the exploitation of system resource exhaustion through denial of service attacks, though in this case the attack vector is more subtle and involves the manipulation of kernel data structures rather than direct resource exhaustion.
The implementation of this fix requires careful attention to kernel memory management principles and proper synchronization of buffer state information. The solution ensures that when ring buffers are reset, all pages are properly cleared to prevent the accumulation of stale entries that could cause buffer state inconsistencies. This approach prevents the scenario where ring_buffer_empty_cpu() returns true while rb_num_of_entries() returns zero, eliminating the infinite loop condition that leads to soft lockup. The fix represents a defensive programming approach that addresses the root cause rather than merely patching symptoms, making it more robust against similar issues in the future. This vulnerability highlights the complexity of kernel-level memory management and the critical importance of proper state handling in kernel subsystems. The fix ensures that buffer reset operations properly clear all memory pages, preventing the accumulation of stale data that could lead to incorrect buffer state reporting and subsequent system lockup conditions.