PT-2025-40216 · Linux+4 · Linux Kernel+4

Published 2023-01-03 · Updated 2026-05-26 · CVE-2023-53509

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.4.182+ #202104120910+6d1da174272d.61x

Description The Linux kernel contains a flaw within the qed driver related to the qed mcp trace dump() function. The qed mcp cmd and union() function can cause delays exceeding 5 seconds when calling qed mcp nvm rd cmd(), potentially leading to thread scheduling delays. The issue arises because qed mcp trace dump() is called from ethtool, where sleeping is permitted, but the necessary "can sleep" parameters were not propagated to related functions (qed find nvram image() and qed nvram read()). This can result in threads becoming unresponsive for extended periods, as demonstrated by observed delays exceeding 700ms in production environments. The stack trace indicates the issue originates within the qed driver during an ethtool operation.

Recommendations Update to Linux kernel version 4.4.182+ #202104120910+6d1da174272d.61x or a later version.

Exploit

Fix

Assertion Failure

Resource Exhaustion

Weakness Enumeration

CWE-617

CWE-400

Related Identifiers

AZL-75107

BDU:2025-12892

CVE-2023-53509

SUSE-SU-2025:03615-1

SUSE-SU-2025:03628-1

SUSE-SU-2025:3716-1

SUSE-SU-2025:3761-1

Affected Products

Debian

Linux Kernel

Suse

Ethtool

Qed

References · 865

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53509.json · Exploit
• https://osv.dev/vulnerability/AZL-75107 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12892 · Security Note
• https://git.kernel.org/stable/c/50c81b35df01db12b348c5cbf4b1917dc9a7db54 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:03615-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-53509 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-53509 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53509 · Vendor Advisory
• https://git.kernel.org/stable/c/e0387f4f39a8d92302273ac356d1f6b2a38160d8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-53509 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2023-53509 · Vendor Advisory
• https://git.kernel.org/stable/c/5401c3e0992860b11fb4b25796e4c4f1921740df · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:3716-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-53509 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-53509 · Vendor Advisory