PT-2025-13339 · Linux+4 · Linux Kernel+4
Published
2023-01-09
·
Updated
2025-09-29
·
CVE-2023-52993
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability in the Linux kernel has been resolved. The issue occurs when the legacy timer interrupt (IRQ0) is resent in software, which happens in soft interrupt (tasklet) context, leading to a NULL pointer dereference in the periodic tick code. This happens because the legacy PIC interrupts are level triggered and should never be resent in software, but the IRQ LEVEL flag is not set on those interrupts. The problem is triggered by a spurious APIC interrupt on the IRQ0 vector, which is captured and leads to a resend when the legacy timer interrupt is enabled.
Recommendations
To resolve the issue, ensure that IRQ LEVEL is set when the legacy PCI interrupts are set up. As a temporary workaround, consider disabling the legacy PIC interrupts until a patch is available. Restrict access to the periodic tick code to minimize the risk of exploitation. Avoid using the
get irq regs() function in the affected context until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Hat
Red Os
Suse