CVE-2023-53577: bpf, cpumap: Make sure kthread is running before map update returns
In the Linux kernel, the following vulnerability has been resolved:
bpf, cpumap: Make sure kthread is running before map update returns
The following warning was reported when running stress-mode enabled
xdp_redirect_cpu with some RT threads:
------------[ cut here ]------------
WARNING: CPU: 4 PID: 65 at kernel/bpf/cpumap.c:135
CPU: 4 PID: 65 Comm: kworker/4:1 Not tainted 6.5.0-rc2+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
Workqueue: events cpu_map_kthread_stop
RIP: 0010:put_cpu_map_entry+0xda/0x220
......
Call Trace:
<TASK>
? show_regs+0x65/0x70
? __warn+0xa5/0x240
......
? put_cpu_map_entry+0xda/0x220
cpu_map_kthread_stop+0x41/0x60
process_one_work+0x6b0/0xb80
worker_thread+0x96/0x720
kthread+0x1a5/0x1f0
ret_from_fork+0x3a/0x70
ret_from_fork_asm+0x1b/0x30
</TASK>
The root cause is the same as commit 436901649731 ("bpf: cpumap: Fix memory
leak in cpu_map_update_elem"). The kthread is stopped prematurely by
kthread_stop() in cpu_map_kthread_stop(), and kthread() doesn't call
cpu_map_kthread_run() at all but XDP program has already queued some
frames or skbs into ptr_ring. So when __cpu_map_ring_cleanup() checks
the ptr_ring, it will find it was not emptied and report a warning.
An alternative fix is to use __cpu_map_ring_cleanup() to drop these
pending frames or skbs when kthread_stop() returns -EINTR, but it may
confuse the user, because these frames or skbs have been handled
correctly by XDP program. So instead of dropping these frames or skbs,
just make sure the per-cpu kthread is running before
__cpu_map_entry_alloc() returns.
After apply the fix, the error handle for kthread_stop() will be
unnecessary because it will always return 0, so just remove it.
Security readout for executives and security teams
Plain-English summary
A Linux kernel race can let a BPF CPU-map update finish before its per-CPU worker thread is running. Under stressed XDP traffic and real-time scheduling, queued network frames may remain during cleanup and trigger a kernel warning. The supplied severity is high, but the source bundle does not document demonstrated data theft, system takeover, or service disruption.
Executive priority
Treat this as a high-priority kernel maintenance issue on systems using XDP and BPF cpumap. Schedule prompt patching through normal change controls, with faster action for exposed networking infrastructure or multi-user hosts. Broad emergency response is not supported by the supplied evidence because active exploitation is unreported and the stated attack vector is local.
Technical view
The flaw affects BPF cpumap lifecycle synchronization. A premature kthread_stop() can prevent cpu_map_kthread_run() from executing after XDP has queued frames or skbs into ptr_ring. Cleanup then finds an unemptied ring and warns. The upstream fix waits until the per-CPU kthread is running before allocation returns and removes now-unnecessary kthread_stop() error handling.
Likely exposure
Prioritize Linux systems on the listed affected versions that enable or use BPF cpumap with XDP redirection, especially under concurrent or real-time workloads. The CVSS vector requires local access and low privileges, so this is not described as directly remotely exploitable. Exact distribution package exposure must be confirmed with vendor advisories or backport records.
Exploitation context
CVE-2023-53577 is not listed as KEV in the supplied bundle, and no cited source reports active exploitation or a public exploit. The documented reproduction involved stress-mode xdp_redirect_cpu with real-time threads. CVSS assigns high confidentiality, integrity, and availability impacts, although the description itself primarily documents a race, pending frames, and a kernel warning.
Researcher notes
The supplied affected-version data is unusual: it lists 4.15, 0, 5.15.126, 6.1.45, 6.4.10, and 6.5, plus repeated commit identifiers marked unaffected. Validate each distribution through its own advisory. Four stable-kernel commits are provided, but the bundle does not map each commit to a branch or identify a CWE.
Mitigation direction
Update to a vendor-supported kernel containing the applicable referenced stable fix.
Check distribution advisories and changelogs for backports rather than relying only on displayed kernel versions.
Prioritize hosts using XDP redirection or BPF CPU maps.
If immediate patching is unavailable, review vendor guidance for supported temporary mitigations.
Validation and detection
Inventory kernel versions across hosts and compare them with vendor backport records.
Determine whether XDP programs use BPF CPU maps on affected systems.
Confirm the installed kernel contains the applicable stable fix commit.
Monitor kernel logs for cpumap cleanup warnings resembling put_cpu_map_entry or cpu_map_kthread_stop.
After updating, repeat authorized workload testing and confirm the warning no longer occurs.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-53577 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
5Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.