LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53815: posix-timers: Prevent RT livelock in itimer_delete()

In the Linux kernel, the following vulnerability has been resolved: posix-timers: Prevent RT livelock in itimer_delete() itimer_delete() has a retry loop when the timer is concurrently expired. On non-RT kernels this just spin-waits until the timer callback has completed, except for posix CPU timers which have HAVE_POSIX_CPU_TIMERS_TASK_WORK enabled. In that case and on RT kernels the existing task could live lock when preempting the task which does the timer delivery. Replace spin_unlock() with an invocation of timer_wait_running() to handle it the same way as the other retry loops in the posix timer code.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can cause a real-time capable system to livelock while deleting a POSIX interval timer during concurrent timer expiration. The available record does not provide CVSS, CWE, or confirmed exploitation. Business urgency depends on whether exposed systems run affected Linux kernels, especially real-time or latency-sensitive workloads.

Executive priority

Treat as a targeted kernel reliability risk until vendor severity is available. It is not currently supported as an emergency internet-scale exploitation issue by the supplied evidence, but affected high-availability or real-time Linux systems should be patched through normal kernel maintenance windows.

Technical view

The flaw is in itimer_delete(). A retry loop could spin while a timer callback was concurrently running. On RT kernels, or POSIX CPU timer task-work paths, this could livelock when preempting the task delivering the timer. The kernel fix replaces spin_unlock() behavior with timer_wait_running(), aligning this path with other POSIX timer retry loops.

Likely exposure

Exposure is limited to Linux systems matching the CVE record's affected kernel version data. The source names Linux only and lists version markers including 5.4, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, and 6.5. Map this to actual distribution kernel packages before prioritizing.

Exploitation context

The provided sources do not claim active exploitation, public exploit availability, or KEV listing. The described impact is livelock, most relevant where untrusted or lower-trust workloads can exercise POSIX timer behavior on affected kernels.

Researcher notes

The record describes a concurrency/livelock fix rather than memory corruption or privilege escalation. Key evidence is the kernel commit rationale for itimer_delete() and timer_wait_running(). The CVE metadata is incomplete: no CVSS, CWE, or distribution-specific package status is included.

Mitigation direction

  • Check Linux distribution advisories for CVE-2023-53815 package status.
  • Update affected kernels to builds containing the referenced stable fixes.
  • Prioritize real-time, latency-sensitive, and multi-tenant Linux systems.
  • If patch timing is unclear, follow vendor kernel mitigation guidance.

Validation and detection

  • Inventory running Linux kernel versions across production and edge systems.
  • Map kernel builds to distribution advisories for CVE-2023-53815.
  • Confirm whether deployed kernels include one of the referenced stable commits.
  • Review exposure of workloads using POSIX timers on RT-capable systems.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53815 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxec8f954a40da8cd3d159713b608e901f0cd909a9, ec8f954a40da8cd3d159713b608e901f0cd909a9, ec8f954a40da8cd3d159713b608e901f0cd909a9, ec8f954a40da8cd3d159713b608e901f0cd909a9, ec8f954a40da8cd3d159713b608e901f0cd909a9, ec8f954a40da8cd3d159713b608e901f0cd909a9unaffected
LinuxLinux5.4, 0, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.