LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53623: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()

In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() The si->lock must be held when deleting the si from the available list. Otherwise, another thread can re-add the si to the available list, which can lead to memory corruption. The only place we have found where this happens is in the swapoff path. This case can be described as below: core 0 core 1 swapoff del_from_avail_list(si) waiting try lock si->lock acquire swap_avail_lock and re-add si into swap_avail_head acquire si->lock but missing si already being added again, and continuing to clear SWP_WRITEOK, etc. It can be easily found that a massive warning messages can be triggered inside get_swap_pages() by some special cases, for example, we call madvise(MADV_PAGEOUT) on blocks of touched memory concurrently, meanwhile, run much swapon-swapoff operations (e.g. stress-ng-swap). However, in the worst case, panic can be caused by the above scene. In swapoff(), the memory used by si could be kept in swap_info[] after turning off a swap. This means memory corruption will not be caused immediately until allocated and reset for a new swap in the swapon path. A panic message caused: (with CONFIG_PLIST_DEBUG enabled) ------------[ cut here ]------------ top: 00000000e58a3003, n: 0000000013e75cda, p: 000000008cd4451a prev: 0000000035b1e58a, n: 000000008cd4451a, p: 000000002150ee8d next: 000000008cd4451a, n: 000000008cd4451a, p: 000000008cd4451a WARNING: CPU: 21 PID: 1843 at lib/plist.c:60 plist_check_prev_next_node+0x50/0x70 Modules linked in: rfkill(E) crct10dif_ce(E)... CPU: 21 PID: 1843 Comm: stress-ng Kdump: ... 5.10.134+ Hardware name: Alibaba Cloud ECS, BIOS 0.0.0 02/06/2015 pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) pc : plist_check_prev_next_node+0x50/0x70 lr : plist_check_prev_next_node+0x50/0x70 sp : ffff0018009d3c30 x29: ffff0018009d3c40 x28: ffff800011b32a98 x27: 0000000000000000 x26: ffff001803908000 x25: ffff8000128ea088 x24: ffff800011b32a48 x23: 0000000000000028 x22: ffff001800875c00 x21: ffff800010f9e520 x20: ffff001800875c00 x19: ffff001800fdc6e0 x18: 0000000000000030 x17: 0000000000000000 x16: 0000000000000000 x15: 0736076307640766 x14: 0730073007380731 x13: 0736076307640766 x12: 0730073007380731 x11: 000000000004058d x10: 0000000085a85b76 x9 : ffff8000101436e4 x8 : ffff800011c8ce08 x7 : 0000000000000000 x6 : 0000000000000001 x5 : ffff0017df9ed338 x4 : 0000000000000001 x3 : ffff8017ce62a000 x2 : ffff0017df9ed340 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: plist_check_prev_next_node+0x50/0x70 plist_check_head+0x80/0xf0 plist_add+0x28/0x140 add_to_avail_list+0x9c/0xf0 _enable_swap_info+0x78/0xb4 __do_sys_swapon+0x918/0xa10 __arm64_sys_swapon+0x20/0x30 el0_svc_common+0x8c/0x220 do_el0_svc+0x2c/0x90 el0_svc+0x1c/0x30 el0_sync_handler+0xa8/0xb0 el0_sync+0x148/0x180 irq event stamp: 2082270 Now, si->lock locked before calling 'del_from_avail_list()' to make sure other thread see the si had been deleted and SWP_WRITEOK cleared together, will not reinsert again. This problem exists in versions after stable 5.10.y.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw is a race condition in swap handling. Under concurrent swapoff and memory page-out activity, kernel bookkeeping for swap availability can be corrupted, leading to warnings or a system panic. The source does not report remote exploitation or confirmed active exploitation.

Executive priority

Treat this as a stability and availability risk, not a confirmed internet-scale emergency. Patch through normal kernel maintenance, with higher urgency for Linux hosts using swap heavily or relying on automation that changes swap state.

Technical view

The bug occurs because swap_info_struct could be deleted from the available list without holding si->lock, allowing another thread to re-add it while swapoff clears state. The fix locks si->lock before del_from_avail_list(), keeping deletion and SWP_WRITEOK clearing consistent.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel lines with swap enabled, especially systems where privileged users or automation perform swapon and swapoff operations. The source states the problem exists after stable 5.10.y, while affected-version metadata should be confirmed against vendor kernels.

Exploitation context

The source describes warning floods and possible panic using concurrent MADV_PAGEOUT activity and repeated swapon-swapoff operations. It does not cite public exploitation, weaponized exploit code, remote reachability, or inclusion in CISA KEV.

Researcher notes

Evidence supports a local kernel race causing memory corruption and possible panic. The source does not provide CVSS, CWE, exploit status, or precise distribution package mappings. Affected-version metadata appears broad, so validate against upstream stable commits and downstream vendor backports.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable swap race fix.
  • Check Linux distribution advisories for exact fixed package versions.
  • Reduce operational swapon-swapoff churn until patched, where feasible.
  • Limit swap management privileges to trusted administrators and automation.
  • Monitor kernels for swap, plist, or get_swap_pages warnings.

Validation and detection

  • Inventory Linux kernel versions and compare them with vendor fixed builds.
  • Confirm whether affected systems use swap in production.
  • Review logs for get_swap_pages, plist, swapoff, or swapon-related warnings.
  • Verify installed kernel includes the stable fix commit from vendor sources.
  • Prioritize testing on systems with swap automation or heavy memory pressure.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53623 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa2468cc9bfdff6139f59ca896671e5819ff5f94a, a2468cc9bfdff6139f59ca896671e5819ff5f94a, a2468cc9bfdff6139f59ca896671e5819ff5f94a, a2468cc9bfdff6139f59ca896671e5819ff5f94a, a2468cc9bfdff6139f59ca896671e5819ff5f94a, a2468cc9bfdff6139f59ca896671e5819ff5f94a, a2468cc9bfdff6139f59ca896671e5819ff5f94a, a2468cc9bfdff6139f59ca896671e5819ff5f94aunaffected
LinuxLinux4.14, 0, 4.14.313, 4.19.281, 5.4.241, 5.10.178, 5.15.107, 6.1.24, 6.2.11, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.