{"api_version":"1","generated_at":"2026-11-06T07:23:51+00:00","cve":"CVE-2023-53623","urls":{"html":"https://cve.report/CVE-2023-53623","api":"https://cve.report/api/cve/CVE-2023-53623.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-53623","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-53623"},"summary":{"title":"mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/swap: fix swap_info_struct race between swapoff and get_swap_pages()\n\nThe si->lock must be held when deleting the si from the available list. \nOtherwise, another thread can re-add the si to the available list, which\ncan lead to memory corruption.  The only place we have found where this\nhappens is in the swapoff path.  This case can be described as below:\n\ncore 0                       core 1\nswapoff\n\ndel_from_avail_list(si)      waiting\n\ntry lock si->lock            acquire swap_avail_lock\n                             and re-add si into\n                             swap_avail_head\n\nacquire si->lock but missing si already being added again, and continuing\nto clear SWP_WRITEOK, etc.\n\nIt can be easily found that a massive warning messages can be triggered\ninside get_swap_pages() by some special cases, for example, we call\nmadvise(MADV_PAGEOUT) on blocks of touched memory concurrently, meanwhile,\nrun much swapon-swapoff operations (e.g.  stress-ng-swap).\n\nHowever, in the worst case, panic can be caused by the above scene.  In\nswapoff(), the memory used by si could be kept in swap_info[] after\nturning off a swap.  This means memory corruption will not be caused\nimmediately until allocated and reset for a new swap in the swapon path. \nA panic message caused: (with CONFIG_PLIST_DEBUG enabled)\n\n------------[ cut here ]------------\ntop: 00000000e58a3003, n: 0000000013e75cda, p: 000000008cd4451a\nprev: 0000000035b1e58a, n: 000000008cd4451a, p: 000000002150ee8d\nnext: 000000008cd4451a, n: 000000008cd4451a, p: 000000008cd4451a\nWARNING: CPU: 21 PID: 1843 at lib/plist.c:60 plist_check_prev_next_node+0x50/0x70\nModules linked in: rfkill(E) crct10dif_ce(E)...\nCPU: 21 PID: 1843 Comm: stress-ng Kdump: ... 5.10.134+\nHardware name: Alibaba Cloud ECS, BIOS 0.0.0 02/06/2015\npstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)\npc : plist_check_prev_next_node+0x50/0x70\nlr : plist_check_prev_next_node+0x50/0x70\nsp : ffff0018009d3c30\nx29: ffff0018009d3c40 x28: ffff800011b32a98\nx27: 0000000000000000 x26: ffff001803908000\nx25: ffff8000128ea088 x24: ffff800011b32a48\nx23: 0000000000000028 x22: ffff001800875c00\nx21: ffff800010f9e520 x20: ffff001800875c00\nx19: ffff001800fdc6e0 x18: 0000000000000030\nx17: 0000000000000000 x16: 0000000000000000\nx15: 0736076307640766 x14: 0730073007380731\nx13: 0736076307640766 x12: 0730073007380731\nx11: 000000000004058d x10: 0000000085a85b76\nx9 : ffff8000101436e4 x8 : ffff800011c8ce08\nx7 : 0000000000000000 x6 : 0000000000000001\nx5 : ffff0017df9ed338 x4 : 0000000000000001\nx3 : ffff8017ce62a000 x2 : ffff0017df9ed340\nx1 : 0000000000000000 x0 : 0000000000000000\nCall trace:\n plist_check_prev_next_node+0x50/0x70\n plist_check_head+0x80/0xf0\n plist_add+0x28/0x140\n add_to_avail_list+0x9c/0xf0\n _enable_swap_info+0x78/0xb4\n __do_sys_swapon+0x918/0xa10\n __arm64_sys_swapon+0x20/0x30\n el0_svc_common+0x8c/0x220\n do_el0_svc+0x2c/0x90\n el0_svc+0x1c/0x30\n el0_sync_handler+0xa8/0xb0\n el0_sync+0x148/0x180\nirq event stamp: 2082270\n\nNow, si->lock locked before calling 'del_from_avail_list()' to make sure\nother thread see the si had been deleted and SWP_WRITEOK cleared together,\nwill not reinsert again.\n\nThis problem exists in versions after stable 5.10.y.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-10-07 16:15:45","updated_at":"2026-11-05 21:17:29"},"problem_types":["CWE-362"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"4.7","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/85cc118ce6f1a627901b6db50c9d01f2ad78cdbf","name":"https://git.kernel.org/stable/c/85cc118ce6f1a627901b6db50c9d01f2ad78cdbf","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a55f268abdb74ac5633b75a09fefb58458e9d2a2","name":"https://git.kernel.org/stable/c/a55f268abdb74ac5633b75a09fefb58458e9d2a2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/111a79d9b92f0a679fe300ccd3119ae9741f3d54","name":"https://git.kernel.org/stable/c/111a79d9b92f0a679fe300ccd3119ae9741f3d54","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b9927d3a60ca9ed35625470888629c074e687ba0","name":"https://git.kernel.org/stable/c/b9927d3a60ca9ed35625470888629c074e687ba0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e7bba7ddb4318d5ea939c8db747c2c2780ab66f4","name":"https://git.kernel.org/stable/c/e7bba7ddb4318d5ea939c8db747c2c2780ab66f4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6fe7d6b992113719e96744d974212df3fcddc76c","name":"https://git.kernel.org/stable/c/6fe7d6b992113719e96744d974212df3fcddc76c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4bdf1514b4268d29360ba9e43becdd49955bc7ae","name":"https://git.kernel.org/stable/c/4bdf1514b4268d29360ba9e43becdd49955bc7ae","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ea8c42b3b6d95ced3a4f555f04686d00ef0bb206","name":"https://git.kernel.org/stable/c/ea8c42b3b6d95ced3a4f555f04686d00ef0bb206","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-53623","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53623","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a2468cc9bfdff6139f59ca896671e5819ff5f94a 111a79d9b92f0a679fe300ccd3119ae9741f3d54 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a2468cc9bfdff6139f59ca896671e5819ff5f94a a55f268abdb74ac5633b75a09fefb58458e9d2a2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a2468cc9bfdff6139f59ca896671e5819ff5f94a e7bba7ddb4318d5ea939c8db747c2c2780ab66f4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a2468cc9bfdff6139f59ca896671e5819ff5f94a ea8c42b3b6d95ced3a4f555f04686d00ef0bb206 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a2468cc9bfdff6139f59ca896671e5819ff5f94a 4bdf1514b4268d29360ba9e43becdd49955bc7ae git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a2468cc9bfdff6139f59ca896671e5819ff5f94a 85cc118ce6f1a627901b6db50c9d01f2ad78cdbf git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a2468cc9bfdff6139f59ca896671e5819ff5f94a b9927d3a60ca9ed35625470888629c074e687ba0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a2468cc9bfdff6139f59ca896671e5819ff5f94a 6fe7d6b992113719e96744d974212df3fcddc76c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.14","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.14.313 4.14.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.19.281 4.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.241 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.178 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.107 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.24 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.2.11 6.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"53623","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2023-53623","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:25:55.331016Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-05T20:31:18.272Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/swapfile.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"111a79d9b92f0a679fe300ccd3119ae9741f3d54","status":"affected","version":"a2468cc9bfdff6139f59ca896671e5819ff5f94a","versionType":"git"},{"lessThan":"a55f268abdb74ac5633b75a09fefb58458e9d2a2","status":"affected","version":"a2468cc9bfdff6139f59ca896671e5819ff5f94a","versionType":"git"},{"lessThan":"e7bba7ddb4318d5ea939c8db747c2c2780ab66f4","status":"affected","version":"a2468cc9bfdff6139f59ca896671e5819ff5f94a","versionType":"git"},{"lessThan":"ea8c42b3b6d95ced3a4f555f04686d00ef0bb206","status":"affected","version":"a2468cc9bfdff6139f59ca896671e5819ff5f94a","versionType":"git"},{"lessThan":"4bdf1514b4268d29360ba9e43becdd49955bc7ae","status":"affected","version":"a2468cc9bfdff6139f59ca896671e5819ff5f94a","versionType":"git"},{"lessThan":"85cc118ce6f1a627901b6db50c9d01f2ad78cdbf","status":"affected","version":"a2468cc9bfdff6139f59ca896671e5819ff5f94a","versionType":"git"},{"lessThan":"b9927d3a60ca9ed35625470888629c074e687ba0","status":"affected","version":"a2468cc9bfdff6139f59ca896671e5819ff5f94a","versionType":"git"},{"lessThan":"6fe7d6b992113719e96744d974212df3fcddc76c","status":"affected","version":"a2468cc9bfdff6139f59ca896671e5819ff5f94a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/swapfile.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.14.*","status":"unaffected","version":"4.14.313","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.281","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.241","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.178","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.107","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.24","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.14.313","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.19.281","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.241","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.178","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.107","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.24","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.2.11","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.3","versionStartIncluding":"4.14","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/swap: fix swap_info_struct race between swapoff and get_swap_pages()\n\nThe si->lock must be held when deleting the si from the available list. \nOtherwise, another thread can re-add the si to the available list, which\ncan lead to memory corruption.  The only place we have found where this\nhappens is in the swapoff path.  This case can be described as below:\n\ncore 0                       core 1\nswapoff\n\ndel_from_avail_list(si)      waiting\n\ntry lock si->lock            acquire swap_avail_lock\n                             and re-add si into\n                             swap_avail_head\n\nacquire si->lock but missing si already being added again, and continuing\nto clear SWP_WRITEOK, etc.\n\nIt can be easily found that a massive warning messages can be triggered\ninside get_swap_pages() by some special cases, for example, we call\nmadvise(MADV_PAGEOUT) on blocks of touched memory concurrently, meanwhile,\nrun much swapon-swapoff operations (e.g.  stress-ng-swap).\n\nHowever, in the worst case, panic can be caused by the above scene.  In\nswapoff(), the memory used by si could be kept in swap_info[] after\nturning off a swap.  This means memory corruption will not be caused\nimmediately until allocated and reset for a new swap in the swapon path. \nA panic message caused: (with CONFIG_PLIST_DEBUG enabled)\n\n------------[ cut here ]------------\ntop: 00000000e58a3003, n: 0000000013e75cda, p: 000000008cd4451a\nprev: 0000000035b1e58a, n: 000000008cd4451a, p: 000000002150ee8d\nnext: 000000008cd4451a, n: 000000008cd4451a, p: 000000008cd4451a\nWARNING: CPU: 21 PID: 1843 at lib/plist.c:60 plist_check_prev_next_node+0x50/0x70\nModules linked in: rfkill(E) crct10dif_ce(E)...\nCPU: 21 PID: 1843 Comm: stress-ng Kdump: ... 5.10.134+\nHardware name: Alibaba Cloud ECS, BIOS 0.0.0 02/06/2015\npstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)\npc : plist_check_prev_next_node+0x50/0x70\nlr : plist_check_prev_next_node+0x50/0x70\nsp : ffff0018009d3c30\nx29: ffff0018009d3c40 x28: ffff800011b32a98\nx27: 0000000000000000 x26: ffff001803908000\nx25: ffff8000128ea088 x24: ffff800011b32a48\nx23: 0000000000000028 x22: ffff001800875c00\nx21: ffff800010f9e520 x20: ffff001800875c00\nx19: ffff001800fdc6e0 x18: 0000000000000030\nx17: 0000000000000000 x16: 0000000000000000\nx15: 0736076307640766 x14: 0730073007380731\nx13: 0736076307640766 x12: 0730073007380731\nx11: 000000000004058d x10: 0000000085a85b76\nx9 : ffff8000101436e4 x8 : ffff800011c8ce08\nx7 : 0000000000000000 x6 : 0000000000000001\nx5 : ffff0017df9ed338 x4 : 0000000000000001\nx3 : ffff8017ce62a000 x2 : ffff0017df9ed340\nx1 : 0000000000000000 x0 : 0000000000000000\nCall trace:\n plist_check_prev_next_node+0x50/0x70\n plist_check_head+0x80/0xf0\n plist_add+0x28/0x140\n add_to_avail_list+0x9c/0xf0\n _enable_swap_info+0x78/0xb4\n __do_sys_swapon+0x918/0xa10\n __arm64_sys_swapon+0x20/0x30\n el0_svc_common+0x8c/0x220\n do_el0_svc+0x2c/0x90\n el0_svc+0x1c/0x30\n el0_sync_handler+0xa8/0xb0\n el0_sync+0x148/0x180\nirq event stamp: 2082270\n\nNow, si->lock locked before calling 'del_from_avail_list()' to make sure\nother thread see the si had been deleted and SWP_WRITEOK cleared together,\nwill not reinsert again.\n\nThis problem exists in versions after stable 5.10.y."}],"providerMetadata":{"dateUpdated":"2026-05-11T19:48:44.159Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/111a79d9b92f0a679fe300ccd3119ae9741f3d54"},{"url":"https://git.kernel.org/stable/c/a55f268abdb74ac5633b75a09fefb58458e9d2a2"},{"url":"https://git.kernel.org/stable/c/e7bba7ddb4318d5ea939c8db747c2c2780ab66f4"},{"url":"https://git.kernel.org/stable/c/ea8c42b3b6d95ced3a4f555f04686d00ef0bb206"},{"url":"https://git.kernel.org/stable/c/4bdf1514b4268d29360ba9e43becdd49955bc7ae"},{"url":"https://git.kernel.org/stable/c/85cc118ce6f1a627901b6db50c9d01f2ad78cdbf"},{"url":"https://git.kernel.org/stable/c/b9927d3a60ca9ed35625470888629c074e687ba0"},{"url":"https://git.kernel.org/stable/c/6fe7d6b992113719e96744d974212df3fcddc76c"}],"title":"mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2023-53623","datePublished":"2025-10-07T15:19:28.834Z","dateReserved":"2025-10-07T15:16:59.655Z","dateUpdated":"2026-11-05T20:31:18.272Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-10-07 16:15:45","lastModifiedDate":"2026-11-05 21:17:29","problem_types":["CWE-362"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-05T20:25:55.331016Z","id":"CVE-2023-53623","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"4.14.313","matchCriteriaId":"DFA59AFE-B8F0-4E00-BB7D-C10421332C57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"4.19.281","matchCriteriaId":"FA9A5EE5-EA8C-4F9C-8205-020D45B82C9B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.4.241","matchCriteriaId":"A6C89301-5E43-4A77-878F-AC2043FD2741"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.178","matchCriteriaId":"896B51EF-6427-4DFF-A2CA-819B349840A1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.107","matchCriteriaId":"6BCC0C73-754E-4985-A087-F74888650709"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.24","matchCriteriaId":"E6EC432F-985F-450F-954E-7EAD42ADA1F8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.2.11","matchCriteriaId":"93C03C9A-798F-4CD5-912F-A436BFA0CC7E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*","matchCriteriaId":"B8E3B0E8-FA27-4305-87BB-AF6C25B160CB"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*","matchCriteriaId":"A47F0FC3-CE52-4BA1-BA51-22F783938431"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*","matchCriteriaId":"3583026A-27EC-4A4C-850A-83F2AF970673"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.3:rc4:*:*:*:*:*:*","matchCriteriaId":"DC271202-7570-4505-89A4-D602D47BFD00"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.3:rc5:*:*:*:*:*:*","matchCriteriaId":"D413BB6D-4F74-4C7D-9163-47786619EF53"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"53623","Ordinal":"1","Title":"mm/swap: fix swap_info_struct race between swapoff and get_swap_","CVE":"CVE-2023-53623","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"53623","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/swap: fix swap_info_struct race between swapoff and get_swap_pages()\n\nThe si->lock must be held when deleting the si from the available list. \nOtherwise, another thread can re-add the si to the available list, which\ncan lead to memory corruption.  The only place we have found where this\nhappens is in the swapoff path.  This case can be described as below:\n\ncore 0                       core 1\nswapoff\n\ndel_from_avail_list(si)      waiting\n\ntry lock si->lock            acquire swap_avail_lock\n                             and re-add si into\n                             swap_avail_head\n\nacquire si->lock but missing si already being added again, and continuing\nto clear SWP_WRITEOK, etc.\n\nIt can be easily found that a massive warning messages can be triggered\ninside get_swap_pages() by some special cases, for example, we call\nmadvise(MADV_PAGEOUT) on blocks of touched memory concurrently, meanwhile,\nrun much swapon-swapoff operations (e.g.  stress-ng-swap).\n\nHowever, in the worst case, panic can be caused by the above scene.  In\nswapoff(), the memory used by si could be kept in swap_info[] after\nturning off a swap.  This means memory corruption will not be caused\nimmediately until allocated and reset for a new swap in the swapon path. \nA panic message caused: (with CONFIG_PLIST_DEBUG enabled)\n\n------------[ cut here ]------------\ntop: 00000000e58a3003, n: 0000000013e75cda, p: 000000008cd4451a\nprev: 0000000035b1e58a, n: 000000008cd4451a, p: 000000002150ee8d\nnext: 000000008cd4451a, n: 000000008cd4451a, p: 000000008cd4451a\nWARNING: CPU: 21 PID: 1843 at lib/plist.c:60 plist_check_prev_next_node+0x50/0x70\nModules linked in: rfkill(E) crct10dif_ce(E)...\nCPU: 21 PID: 1843 Comm: stress-ng Kdump: ... 5.10.134+\nHardware name: Alibaba Cloud ECS, BIOS 0.0.0 02/06/2015\npstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)\npc : plist_check_prev_next_node+0x50/0x70\nlr : plist_check_prev_next_node+0x50/0x70\nsp : ffff0018009d3c30\nx29: ffff0018009d3c40 x28: ffff800011b32a98\nx27: 0000000000000000 x26: ffff001803908000\nx25: ffff8000128ea088 x24: ffff800011b32a48\nx23: 0000000000000028 x22: ffff001800875c00\nx21: ffff800010f9e520 x20: ffff001800875c00\nx19: ffff001800fdc6e0 x18: 0000000000000030\nx17: 0000000000000000 x16: 0000000000000000\nx15: 0736076307640766 x14: 0730073007380731\nx13: 0736076307640766 x12: 0730073007380731\nx11: 000000000004058d x10: 0000000085a85b76\nx9 : ffff8000101436e4 x8 : ffff800011c8ce08\nx7 : 0000000000000000 x6 : 0000000000000001\nx5 : ffff0017df9ed338 x4 : 0000000000000001\nx3 : ffff8017ce62a000 x2 : ffff0017df9ed340\nx1 : 0000000000000000 x0 : 0000000000000000\nCall trace:\n plist_check_prev_next_node+0x50/0x70\n plist_check_head+0x80/0xf0\n plist_add+0x28/0x140\n add_to_avail_list+0x9c/0xf0\n _enable_swap_info+0x78/0xb4\n __do_sys_swapon+0x918/0xa10\n __arm64_sys_swapon+0x20/0x30\n el0_svc_common+0x8c/0x220\n do_el0_svc+0x2c/0x90\n el0_svc+0x1c/0x30\n el0_sync_handler+0xa8/0xb0\n el0_sync+0x148/0x180\nirq event stamp: 2082270\n\nNow, si->lock locked before calling 'del_from_avail_list()' to make sure\nother thread see the si had been deleted and SWP_WRITEOK cleared together,\nwill not reinsert again.\n\nThis problem exists in versions after stable 5.10.y.","Type":"Description","Title":"mm/swap: fix swap_info_struct race between swapoff and get_swap_"}]}}}