PT-2025-40229 · Linux · Linux Kernel
Published
2023-04-05
·
Updated
2025-10-02
·
CVE-2023-53522
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a circular locking dependency between
cpu hotplug lock and freezer mutex within the cgroup freezer subsystem. Specifically, the issue arises from the order in which locks are acquired and released during freezer state changes and CPU hotplug operations. The vulnerability was identified by syzbot, which reported the circular dependency after a code change involving the replacement of atomic inc() with static branch inc() in the freezer apply state() function. The locking order involves cpu hotplug lock being acquired before freezer mutex in certain code paths, and vice versa in others, creating a potential deadlock situation. The affected code paths include functions such as cgroup file write(), cgroup procs write(), cgroup procs write(), cgroup attach lock(), cgroup attach task(), cgroup migrate(), cgroup migrate execute(), freezer attach(), freezer write(), freezer change state(), and freezer apply state().Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel