Linux Kernel up to 6.5.4 cpu_to_node infinite loop

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.5.4. It has been rated as critical. Affected by this vulnerability is the function cpu_to_node. This manipulation causes infinite loop. This vulnerability is tracked as CVE-2023-53496. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel up to 6.5.4. Affected by this vulnerability is the function cpu_to_node. The manipulation with an unknown input leads to a infinite loop vulnerability. The CWE definition for the vulnerability is CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. As an impact it is known to affect availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: x86/platform/uv: Use alternate source for socket to node data The UV code attempts to build a set of tables to allow it to do bidirectional socket<=>node lookups. But when nr_cpus is set to a smaller number than actually present, the cpu_to_node() mapping information for unused CPUs is not available to build_socket_tables(). This results in skipping some nodes or sockets when creating the tables and leaving some -1's for later code to trip. over, causing oopses. The problem is that the socket<=>node lookups are created by doing a loop over all CPUs, then looking up the CPU's APICID and socket. But if a CPU is not present, there is no way to start this lookup. Instead of looping over all CPUs, take CPUs out of the equation entirely. Loop over all APICIDs which are mapped to a valid NUMA node. Then just extract the socket-id from the APICID. This avoid tripping over disabled CPUs.

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2023-53496 since 10/01/2025. The exploitation appears to be easy. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 269619 (Linux Distros Unpatched Vulnerability : CVE-2023-53496), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.5.5 eliminates this vulnerability. Applying the patch 0d01a0c3046d1545391ef7bb1f114743d00e3793/5290e88ba2c742ca77c5f5b690e5af549cfd8591 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (269619), EUVD (EUVD-2025-32760) and CERT Bund (WID-SEC-2025-2187). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• Open Source Linux Kernel
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.5.0
• 6.5.1
• 6.5.2
• 6.5.3
• 6.5.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion