Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ CVE-2023-53231 — kernel

🟡 CVSS 5.5 — Medium ✅ No Known Exploit NVD
5.5
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

erofs: Fix detection of atomic context

In the Linux kernel, the following vulnerability has been resolved:

erofs: Fix detection of atomic context

Current check for atomic context is not sufficient as

z_erofs_decompressqueue_endio can be called under rcu lock

from blk_mq_flush_plug_list(). See the stacktrace [1]

In such case we should hand off the decompression work for async

processing rather than trying to do sync decompression in current

context. Patch fixes the detection by checking for

rcu_read_lock_any_held() and while at it use more appropriate

!in_task() check than in_atomic().

Background: Historically erofs would always schedule a kworker for

decompression which would incur the scheduling cost regardless of

the context. But z_erofs_decompressqueue_endio() may not always

be in atomic context and we could actually benefit from doing the

decompression in z_erofs_decompressqueue_endio() if we are in

thread context, for example when running with dm-verity.

This optimization was later added in patch [2] which has shown

improvement in performance benchmarks.

==============================================

[1] Problem stacktrace

[name:core&]BUG: sleeping function called from invalid context at kernel/locking/mutex.c:291

[name:core&]in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1615, name: CpuMonitorServi

[name:core&]preempt_count: 0, expected: 0

[name:core&]RCU nest depth: 1, expected: 0

CPU: 7 PID: 1615 Comm: CpuMonitorServi Tainted: G S W OE 6.1.25-android14-5-maybe-dirty-mainline #1

Hardware name: MT6897 (DT)

Call trace:

dump_backtrace+0x108/0x15c

show_stack+0x20/0x30

dump_stack_lvl+0x6c/0x8c

dump_stack+0x20/0x48

__might_resched+0x1fc/0x308

__might_sleep+0x50/0x88

mutex_lock+0x2c/0x110

z_erofs_decompress_queue+0x11c/0xc10

z_erofs_decompress_kickoff+0x110/0x1a4

z_erofs_decompressqueue_endio+0x154/0x180

bio_endio+0x1b0/0x1d8

__dm_io_complete+0x22c/0x280

clone_endio+0xe4/0x280

bio_endio+0x1b0/0x1d8

blk_update_request+0x138/0x3a4

blk_mq_plug_issue_direct+0xd4/0x19c

blk_mq_flush_plug_list+0x2b0/0x354

__blk_flush_plug+0x110/0x160

blk_finish_plug+0x30/0x4c

read_pages+0x2fc/0x370

page_cache_ra_unbounded+0xa4/0x23c

page_cache_ra_order+0x290/0x320

do_sync_mmap_readahead+0x108/0x2c0

filemap_fault+0x19c/0x52c

__do_fault+0xc4/0x114

handle_mm_fault+0x5b4/0x1168

do_page_fault+0x338/0x4b4

do_translation_fault+0x40/0x60

do_mem_abort+0x60/0xc8

el0_da+0x4c/0xe0

el0t_64_sync_handler+0xd4/0xfc

el0t_64_sync+0x1a0/0x1a4

[2] Link: https://lore.kernel.org/all/[email protected]/

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

  • Attack vector: Local — a local account, shell or session on the host is needed.
  • Attack complexity: Low — the attack works reliably, with no preparation.
  • Privileges required: Low — an ordinary user account is enough.
  • User interaction: None — nobody has to be tricked into anything.
  • Scope: Unchanged — the damage stays inside the vulnerable component.
  • Confidentiality impact: None.
  • Integrity impact: None.
  • Availability impact: High — total loss, or loss the attacker controls.

Affected software

CVE-2023-53231 is recorded against 2 packages.

  • kernel (from 4.19.0 up to 6.4.7)
  • linux-kernel (from 4.19 up to 6.4.7)

Timeline and source

Published on 15 September 2025 and last revised on 12 August 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.

References

git.kernel.org (Web)
git.kernel.org (Web)
github.com (Advisory)
nvd.nist.gov (Advisory)
git.kernel.org (Package)

Other advisories for this package

kernel has other advisories on record. If you are patching this one, these are worth checking on the same host:

Details

Severity Medium
CVSS Score 5.5
CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE N/A
Public Exploit ✅ No
Source NVD
Published 2025-09-15
Updated 2026-08-20
Modified 2026-08-12

Affected Packages

Software From version Fixed in
kernel 4.19.0 6.4.7
linux-kernel 4.19 6.4.7

Similar Threats

Vulnerability Monitoring

Track new vulnerabilities in kernel

CVE-2023-53231 is rated CVSS 5.5 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesCVECVE 2023
✓