LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53668: ring-buffer: Fix deadloop issue on reading trace_pipe

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix deadloop issue on reading trace_pipe Soft lockup occurs when reading file 'trace_pipe': watchdog: BUG: soft lockup - CPU#6 stuck for 22s! [cat:4488] [...] RIP: 0010:ring_buffer_empty_cpu+0xed/0x170 RSP: 0018:ffff88810dd6fc48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff93d1aaeb RDX: ffff88810a280040 RSI: 0000000000000008 RDI: ffff88811164b218 RBP: ffff88811164b218 R08: 0000000000000000 R09: ffff88815156600f R10: ffffed102a2acc01 R11: 0000000000000001 R12: 0000000051651901 R13: 0000000000000000 R14: ffff888115e49500 R15: 0000000000000000 [...] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8d853c2000 CR3: 000000010dcd8000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __find_next_entry+0x1a8/0x4b0 ? peek_next_entry+0x250/0x250 ? down_write+0xa5/0x120 ? down_write_killable+0x130/0x130 trace_find_next_entry_inc+0x3b/0x1d0 tracing_read_pipe+0x423/0xae0 ? tracing_splice_read_pipe+0xcb0/0xcb0 vfs_read+0x16b/0x490 ksys_read+0x105/0x210 ? __ia32_sys_pwrite64+0x200/0x200 ? switch_fpu_return+0x108/0x220 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Through the vmcore, I found it's because in tracing_read_pipe(), ring_buffer_empty_cpu() found some buffer is not empty but then it cannot read anything due to "rb_num_of_entries() == 0" always true, Then it infinitely loop the procedure due to user buffer not been filled, see following code path: tracing_read_pipe() { ... ... waitagain: tracing_wait_pipe() // 1. find non-empty buffer here trace_find_next_entry_inc() // 2. loop here try to find an entry __find_next_entry() ring_buffer_empty_cpu(); // 3. find non-empty buffer peek_next_entry() // 4. but peek always return NULL ring_buffer_peek() rb_buffer_peek() rb_get_reader_page() // 5. because rb_num_of_entries() == 0 always true here // then return NULL // 6. user buffer not been filled so goto 'waitgain' // and eventually leads to an deadloop in kernel!!! } By some analyzing, I found that when resetting ringbuffer, the 'entries' of its pages are not all cleared (see rb_reset_cpu()). Then when reducing the ringbuffer, and if some reduced pages exist dirty 'entries' data, they will be added into 'cpu_buffer->overrun' (see rb_remove_pages()), which cause wrong 'overrun' count and eventually cause the deadloop issue. To fix it, we need to clear every pages in rb_reset_cpu().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-53668 is a Linux kernel bug where reading trace_pipe can push the kernel into an infinite loop and soft lockup. The business impact is likely availability disruption on affected systems, not data theft, based on the provided sources. Public severity scoring is not supplied in the bundle.

Executive priority

Treat this as an availability-risk kernel maintenance item. Prioritize internet-facing or multi-user Linux systems only if tracing interfaces are accessible beyond trusted administrators. Otherwise, handle through normal kernel patch cycles.

Technical view

The issue is in the Linux kernel ring buffer used by tracing. During ring buffer reset and resize, stale page entry counts can corrupt overrun accounting. tracing_read_pipe() may see a non-empty buffer but fail to read entries, repeatedly looping until a soft lockup occurs.

Likely exposure

Exposure is tied to Linux systems running affected kernel versions and using kernel tracing interfaces such as trace_pipe. The bundle does not prove remote reachability, privilege requirements, or which distributions ship vulnerable builds.

Exploitation context

The source bundle describes a reproducible kernel deadloop while reading trace_pipe and marks KEV as false. It provides no evidence of active exploitation, public weaponization, or remote exploitation.

Researcher notes

Evidence is strongest for local kernel availability failure in tracing ring-buffer paths. Missing details include CVSS, CWE, privilege requirements, distribution mapping, and exploit maturity. Validate against vendor kernel trees rather than assuming upstream version strings map directly to packaged kernels.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable ring-buffer fixes.
  • Check distribution advisories for exact fixed package versions.
  • Limit tracefs and tracing interface access to trusted administrators.
  • Avoid exposing debug or tracing interfaces to untrusted users.
  • Schedule reboots where required for kernel replacement.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and containers hosts.
  • Check whether tracefs is mounted and trace_pipe is accessible.
  • Confirm installed kernels include vendor fixes for CVE-2023-53668.
  • Review monitoring for soft lockup messages involving tracing_read_pipe or ring_buffer_empty_cpu.
  • Prioritize systems where untrusted users can access tracing interfaces.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53668 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa5fb833172eca69136e9ee1ada778e404086ab8a, a5fb833172eca69136e9ee1ada778e404086ab8a, a5fb833172eca69136e9ee1ada778e404086ab8a, a5fb833172eca69136e9ee1ada778e404086ab8a, a5fb833172eca69136e9ee1ada778e404086ab8a, a5fb833172eca69136e9ee1ada778e404086ab8a, a5fb833172eca69136e9ee1ada778e404086ab8a, a5fb833172eca69136e9ee1ada778e404086ab8aunaffected
LinuxLinux3.6, 0, 4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.40, 6.4.5, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.