CVE-2023-53727 in Linux
Summary
by MITRE • 10/22/2025
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fq_pie: avoid stalls in fq_pie_timer()
When setting a high number of flows (limit being 65536), fq_pie_timer() is currently using too much time as syzbot reported.
Add logic to yield the cpu every 2048 flows (less than 150 usec on debug kernels). It should also help by not blocking qdisc fast paths for too long. Worst case (65536 flows) would need 31 jiffies for a complete scan.
Relevant extract from syzbot report:
rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 2663 jiffies s: 873 root: 0x1/.
rcu: blocking rcu_node structures (internal RCU debug): Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 5177 Comm: syz-executor273 Not tainted 6.5.0-syzkaller-00453-g727dbda16b83 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]
RIP: 0010:write_comp_data+0x21/0x90 kernel/kcov.c:236 Code: 2e 0f 1f 84 00 00 00 00 00 65 8b 05 01 b2 7d 7e 49 89 f1 89 c6 49 89 d2 81 e6 00 01 00 00 49 89 f8 65 48 8b 14 25 80 b9 03 00 00 01 ff 00 74 0e 85 f6 74 59 8b 82 04 16 00 00 85 c0 74 4f 8b RSP: 0018:ffffc90000007bb8 EFLAGS: 00000206 RAX: 0000000000000101 RBX: ffffc9000dc0d140 RCX: ffffffff885893b0 RDX: ffff88807c075940 RSI: 0000000000000100 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffc9000dc0d178 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000555555d54380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6b442f6130 CR3: 000000006fe1c000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pie_calculate_probability+0x480/0x850 net/sched/sch_pie.c:415 fq_pie_timer+0x1da/0x4f0 net/sched/sch_fq_pie.c:387 call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/28/2026
The vulnerability CVE-2023-53727 addresses a critical performance degradation issue within the Linux kernel's networking subsystem, specifically in the fq_pie queuing discipline implementation. This flaw manifests when systems handle a high volume of network flows, reaching the maximum limit of 65536 flows, leading to significant system stalls and resource contention. The problem originates from the fq_pie_timer() function which, during its processing of numerous flows, consumes excessive CPU time and blocks the queuing discipline's fast paths for extended periods. This behavior directly impacts system responsiveness and can lead to denial of service conditions, particularly in high-throughput network environments where flow management is critical.
The technical root cause lies in the inefficient processing loop within the fq_pie_timer() function that does not implement periodic yielding of CPU resources during its execution. When the system processes the maximum number of flows, the function can take up to 31 jiffies for a complete scan, which translates to substantial delays in network packet processing. The vulnerability was identified through syzbot automated testing which detected RCU (Read-Copy-Update) preemption stalls, indicating that the kernel's synchronization mechanisms were being blocked for extended periods. The reported stalls occurred across multiple CPUs and were traced back to the excessive execution time of the pie_calculate_probability and fq_pie_timer functions within the net/sched subsystem, specifically in the sch_pie.c and sch_fq_pie.c files.
This vulnerability directly maps to CWE-121 and CWE-775 categories related to insufficient resource management and improper handling of resource acquisition. The impact extends beyond simple performance degradation to potentially compromise system availability and responsiveness, particularly in environments with high network throughput requirements such as data centers, network appliances, and high-performance computing clusters. The fix implemented introduces a yield mechanism that forces the CPU to yield every 2048 flows, reducing execution time to less than 150 microseconds on debug kernels. This approach aligns with ATT&CK technique T1499.004 for resource consumption attacks and represents a mitigation strategy that prevents the queuing discipline from monopolizing CPU resources for extended periods. The solution effectively reduces the blocking time of qdisc fast paths and prevents the system from entering states where RCU synchronization mechanisms become blocked, thereby maintaining system stability and network performance under high flow loads.
The fix demonstrates proper kernel programming practices by implementing cooperative multitasking within kernel space to prevent resource starvation. It addresses the fundamental issue of long-running kernel functions that could prevent other system tasks from executing, particularly in real-time or latency-sensitive applications. The mitigation strategy ensures that even under worst-case scenarios with maximum flow counts, the system maintains acceptable responsiveness and prevents the cascading failures that could occur with prolonged CPU blocking. This approach is consistent with Linux kernel design principles that emphasize non-blocking operations and efficient resource utilization, particularly in network subsystems where performance and responsiveness are paramount for maintaining service quality and system reliability.