LiveActive security incident?Get immediate response
CVE Record

CVE-2023-52940: mm: multi-gen LRU: fix crash during cgroup migration

In the Linux kernel, the following vulnerability has been resolved: mm: multi-gen LRU: fix crash during cgroup migration lru_gen_migrate_mm() assumes lru_gen_add_mm() runs prior to itself. This isn't true for the following scenario: CPU 1 CPU 2 clone() cgroup_can_fork() cgroup_procs_write() cgroup_post_fork() task_lock() lru_gen_migrate_mm() task_unlock() task_lock() lru_gen_add_mm() task_unlock() And when the above happens, kernel crashes because of linked list corruption (mm_struct->lru_gen.list).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-52940 is a Linux kernel crash bug in multi-generation LRU memory management during cgroup migration. A race can corrupt a kernel linked list and crash the system. The sources do not show remote exploitation or active exploitation. Business impact is mainly availability for Linux hosts using affected kernel versions and cgroups.

Executive priority

Treat as a scheduled but important availability fix. Prioritize internet-facing service infrastructure only if it also depends on affected Linux kernels and cgroup-heavy workloads. There is no source-backed evidence of active exploitation, but kernel crashes can create meaningful operational disruption.

Technical view

The issue is in lru_gen_migrate_mm(), which assumes lru_gen_add_mm() already ran. During a fork and concurrent cgroup migration, that ordering can be false, corrupting mm_struct->lru_gen.list and causing a kernel crash. The CVE data identifies Linux kernel 6.1-era versions, with fixes referenced in stable kernel commits.

Likely exposure

Exposure is most relevant to Linux systems running affected 6.1-series or related kernels with multi-gen LRU and cgroup activity. Container hosts, multi-tenant Linux servers, and systems using cgroups deserve priority review. The provided sources do not identify affected distributions or appliance products.

Exploitation context

The source describes a race involving process creation and cgroup migration. It supports a denial-of-service style kernel crash, not code execution. No KEV listing or cited source indicates active exploitation. Practical exploitability is not established in the provided evidence.

Researcher notes

Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, distribution matrix, or exploitation report is provided. Analysis should focus on affected kernel lineage, whether multi-gen LRU is present, and whether downstream vendors have backported the fix.

Mitigation direction

  • Identify Linux hosts running affected kernel versions.
  • Prioritize container hosts and systems heavily using cgroups.
  • Apply vendor-supported kernel updates containing the referenced stable fixes.
  • If no update is available, monitor vendor advisories for backports.
  • Avoid relying on unverified workarounds not named by your vendor.

Validation and detection

  • Inventory kernel versions across Linux servers and container hosts.
  • Check whether vendor kernels include the referenced stable commits.
  • Review uptime and crash logs for unexplained kernel panics.
  • Confirm cgroup-heavy systems are included in patch scope.
  • Track remediation status by kernel package, not only upstream version.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-52940 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbd74fdaea146029e4fa12c6de89adbe0779348a9, bd74fdaea146029e4fa12c6de89adbe0779348a9unaffected
LinuxLinux6.1, 0, 6.1.11, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.