LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53577: bpf, cpumap: Make sure kthread is running before map update returns

In the Linux kernel, the following vulnerability has been resolved: bpf, cpumap: Make sure kthread is running before map update returns The following warning was reported when running stress-mode enabled xdp_redirect_cpu with some RT threads: ------------[ cut here ]------------ WARNING: CPU: 4 PID: 65 at kernel/bpf/cpumap.c:135 CPU: 4 PID: 65 Comm: kworker/4:1 Not tainted 6.5.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: events cpu_map_kthread_stop RIP: 0010:put_cpu_map_entry+0xda/0x220 ...... Call Trace: <TASK> ? show_regs+0x65/0x70 ? __warn+0xa5/0x240 ...... ? put_cpu_map_entry+0xda/0x220 cpu_map_kthread_stop+0x41/0x60 process_one_work+0x6b0/0xb80 worker_thread+0x96/0x720 kthread+0x1a5/0x1f0 ret_from_fork+0x3a/0x70 ret_from_fork_asm+0x1b/0x30 </TASK> The root cause is the same as commit 436901649731 ("bpf: cpumap: Fix memory leak in cpu_map_update_elem"). The kthread is stopped prematurely by kthread_stop() in cpu_map_kthread_stop(), and kthread() doesn't call cpu_map_kthread_run() at all but XDP program has already queued some frames or skbs into ptr_ring. So when __cpu_map_ring_cleanup() checks the ptr_ring, it will find it was not emptied and report a warning. An alternative fix is to use __cpu_map_ring_cleanup() to drop these pending frames or skbs when kthread_stop() returns -EINTR, but it may confuse the user, because these frames or skbs have been handled correctly by XDP program. So instead of dropping these frames or skbs, just make sure the per-cpu kthread is running before __cpu_map_entry_alloc() returns. After apply the fix, the error handle for kthread_stop() will be unnecessary because it will always return 0, so just remove it.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel race can let a BPF CPU-map update finish before its per-CPU worker thread is running. Under stressed XDP traffic and real-time scheduling, queued network frames may remain during cleanup and trigger a kernel warning. The supplied severity is high, but the source bundle does not document demonstrated data theft, system takeover, or service disruption.

Executive priority

Treat this as a high-priority kernel maintenance issue on systems using XDP and BPF cpumap. Schedule prompt patching through normal change controls, with faster action for exposed networking infrastructure or multi-user hosts. Broad emergency response is not supported by the supplied evidence because active exploitation is unreported and the stated attack vector is local.

Technical view

The flaw affects BPF cpumap lifecycle synchronization. A premature kthread_stop() can prevent cpu_map_kthread_run() from executing after XDP has queued frames or skbs into ptr_ring. Cleanup then finds an unemptied ring and warns. The upstream fix waits until the per-CPU kthread is running before allocation returns and removes now-unnecessary kthread_stop() error handling.

Likely exposure

Prioritize Linux systems on the listed affected versions that enable or use BPF cpumap with XDP redirection, especially under concurrent or real-time workloads. The CVSS vector requires local access and low privileges, so this is not described as directly remotely exploitable. Exact distribution package exposure must be confirmed with vendor advisories or backport records.

Exploitation context

CVE-2023-53577 is not listed as KEV in the supplied bundle, and no cited source reports active exploitation or a public exploit. The documented reproduction involved stress-mode xdp_redirect_cpu with real-time threads. CVSS assigns high confidentiality, integrity, and availability impacts, although the description itself primarily documents a race, pending frames, and a kernel warning.

Researcher notes

The supplied affected-version data is unusual: it lists 4.15, 0, 5.15.126, 6.1.45, 6.4.10, and 6.5, plus repeated commit identifiers marked unaffected. Validate each distribution through its own advisory. Four stable-kernel commits are provided, but the bundle does not map each commit to a branch or identify a CWE.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable referenced stable fix.
  • Check distribution advisories and changelogs for backports rather than relying only on displayed kernel versions.
  • Prioritize hosts using XDP redirection or BPF CPU maps.
  • If immediate patching is unavailable, review vendor guidance for supported temporary mitigations.

Validation and detection

  • Inventory kernel versions across hosts and compare them with vendor backport records.
  • Determine whether XDP programs use BPF CPU maps on affected systems.
  • Confirm the installed kernel contains the applicable stable fix commit.
  • Monitor kernel logs for cpumap cleanup warnings resembling put_cpu_map_entry or cpu_map_kthread_stop.
  • After updating, repeat authorized workload testing and confirm the warning no longer occurs.
Prepared
Confidence
high
Sources
6

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53577 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2023-53577Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6710e1126934d8b4372b4d2f9ae1646cd3f151bf, 6710e1126934d8b4372b4d2f9ae1646cd3f151bf, 6710e1126934d8b4372b4d2f9ae1646cd3f151bf, 6710e1126934d8b4372b4d2f9ae1646cd3f151bfunaffected
LinuxLinux4.15, 0, 5.15.126, 6.1.45, 6.4.10, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.