LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53624: net/sched: sch_fq: fix integer overflow of "credit"

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq: fix integer overflow of "credit" if sch_fq is configured with "initial quantum" having values greater than INT_MAX, the first assignment of "credit" does signed integer overflow to a very negative value. In this situation, the syzkaller script provided by Cristoph triggers the CPU soft-lockup warning even with few sockets. It's not an infinite loop, but "credit" wasn't probably meant to be minus 2Gb for each new flow. Capping "initial quantum" to INT_MAX proved to fix the issue. v2: validation of "initial quantum" is done in fq_policy, instead of open coding in fq_change() _ suggested by Jakub Kicinski

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-53624 is a Linux kernel traffic-scheduling bug. A very large sch_fq “initial quantum” value can overflow an internal credit counter, causing CPU soft-lockup warnings. The record does not report data theft, remote code execution, or active exploitation.

Executive priority

Treat as a routine-to-prioritized kernel maintenance issue, higher for multi-tenant or untrusted-admin environments. No evidence supports emergency response from the provided sources.

Technical view

In net/sched sch_fq, assigning an initial quantum greater than INT_MAX to the signed credit field can wrap to a large negative value. The upstream fix validates fq_policy input and caps initial quantum at INT_MAX.

Likely exposure

Exposure is most likely on Linux systems running affected kernel builds where sch_fq can be configured with oversized initial quantum values. Distro-specific impact needs vendor kernel mapping.

Exploitation context

The source describes a syzkaller-triggered CPU soft-lockup warning, not an infinite loop. CISA KEV is false in the provided bundle, and no cited source claims active exploitation.

Researcher notes

The record lacks CVSS, CWE, privilege, and distro package details. Analysis should stay anchored to the integer overflow, soft-lockup behavior, and stable commits supplied by the CVE record.

Mitigation direction

  • Upgrade to a kernel containing the referenced stable fixes.
  • Check Linux distribution advisories for backported fixes.
  • Avoid configuring sch_fq initial quantum above INT_MAX.
  • Restrict who can modify traffic-control scheduler settings.

Validation and detection

  • Inventory Linux kernel versions across exposed hosts.
  • Check whether sch_fq is used or configurable on those systems.
  • Map installed kernels to vendor advisories or stable fix commits.
  • Review traffic-control configuration for oversized initial quantum values.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53624 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxafe4fd062416b158a8a8538b23adc1930a9b88dc, afe4fd062416b158a8a8538b23adc1930a9b88dc, afe4fd062416b158a8a8538b23adc1930a9b88dc, afe4fd062416b158a8a8538b23adc1930a9b88dc, afe4fd062416b158a8a8538b23adc1930a9b88dc, afe4fd062416b158a8a8538b23adc1930a9b88dcunaffected
LinuxLinux3.12, 0, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.