{"id":"CVE-2023-53291","state":"PUBLISHED","title":"rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale\n\nRunning the 'kfree_rcu_test' test case [1] results in a splat [2].\nThe root cause is the kfree_scale_thread thread(s) continue running\nafter unloading the rcuscale module.  This commit fixes that isue by\ninvoking kfree_scale_cleanup() from rcu_scale_cleanup() when removing\nthe rcuscale module.\n\n[1] modprobe rcuscale kfree_rcu_test=1\n    // After some time\n    rmmod rcuscale\n    rmmod torture\n\n[2] BUG: unable to handle page fault for address: ffffffffc0601a87\n    #PF: supervisor instruction fetch in kernel mode\n    #PF: error_code(0x0010) - not-present page\n    PGD 11de4f067 P4D 11de4f067 PUD 11de51067 PMD 112f4d067 PTE 0\n    Oops: 0010 [#1] PREEMPT SMP NOPTI\n    CPU: 1 PID: 1798 Comm: kfree_scale_thr Not tainted 6.3.0-rc1-rcu+ #1\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015\n    RIP: 0010:0xffffffffc0601a87\n    Code: Unable to access opcode bytes at 0xffffffffc0601a5d.\n    RSP: 0018:ffffb25bc2e57e18 EFLAGS: 00010297\n    RAX: 0000000000000000 RBX: ffffffffc061f0b6 RCX: 0000000000000000\n    RDX: 0000000000000000 RSI: ffffffff962fd0de RDI: ffffffff962fd0de\n    RBP: ffffb25bc2e57ea8 R08: 0000000000000000 R09: 0000000000000000\n    R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000\n    R13: 0000000000000000 R14: 000000000000000a R15: 00000000001c1dbe\n    FS:  0000000000000000(0000) GS:ffff921fa2200000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: ffffffffc0601a5d CR3: 000000011de4c006 CR4: 0000000000370ee0\n    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n    Call Trace:\n     <TASK>\n     ? kvfree_call_rcu+0xf0/0x3a0\n     ? kthread+0xf3/0x120\n     ? kthread_complete_and_exit+0x20/0x20\n     ? ret_from_fork+0x1f/0x30\n     </TASK>\n    Modules linked in: rfkill sunrpc ... [last unloaded: torture]\n    CR2: ffffffffc0601a87\n    ---[ end trace 0000000000000000 ]---","publishedAt":"2025-09-16T08:11:23.666Z","updatedAt":"2026-05-11T19:42:07.259Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"CISA-ADP"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"604d6a5ff718874904b0fe614878a42b42c0d699","versionType":"git"},{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"f766d45ab294871a3d588ee76c666852f151cad9","versionType":"git"},{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"b8a6ba524d41f4da102e65f90498d9a910839621","versionType":"git"},{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"1dd7547c7610723b2b6afe1a3c4ddb2bde63387c","versionType":"git"},{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"29b1da4f90fc42c91beb4e400d926194925ad31b","versionType":"git"},{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"23fc8df26dead16687ae6eb47b0561a4a832e2f6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/rcu/rcuscale.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.6","versionType":"semver"},{"version":"5.10.188","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.121","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.39","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.3.13","status":"unaffected","lessThanOrEqual":"6.3.*","versionType":"semver"},{"version":"6.4.4","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/rcu/rcuscale.c"]}],"references":["https://git.kernel.org/stable/c/604d6a5ff718874904b0fe614878a42b42c0d699","https://git.kernel.org/stable/c/f766d45ab294871a3d588ee76c666852f151cad9","https://git.kernel.org/stable/c/b8a6ba524d41f4da102e65f90498d9a910839621","https://git.kernel.org/stable/c/1dd7547c7610723b2b6afe1a3c4ddb2bde63387c","https://git.kernel.org/stable/c/29b1da4f90fc42c91beb4e400d926194925ad31b","https://git.kernel.org/stable/c/23fc8df26dead16687ae6eb47b0561a4a832e2f6"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/53xxx/CVE-2023-53291.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53291","state":"PUBLISHED","datePublished":"2025-09-16T08:11:23.666Z","dateUpdated":"2026-05-11T19:42:07.259Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-09-16T08:09:37.992Z"},"containers":{"cna":{"title":"rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale\n\nRunning the 'kfree_rcu_test' test case [1] results in a splat [2].\nThe root cause is the kfree_scale_thread thread(s) continue running\nafter unloading the rcuscale module.  This commit fixes that isue by\ninvoking kfree_scale_cleanup() from rcu_scale_cleanup() when removing\nthe rcuscale module.\n\n[1] modprobe rcuscale kfree_rcu_test=1\n    // After some time\n    rmmod rcuscale\n    rmmod torture\n\n[2] BUG: unable to handle page fault for address: ffffffffc0601a87\n    #PF: supervisor instruction fetch in kernel mode\n    #PF: error_code(0x0010) - not-present page\n    PGD 11de4f067 P4D 11de4f067 PUD 11de51067 PMD 112f4d067 PTE 0\n    Oops: 0010 [#1] PREEMPT SMP NOPTI\n    CPU: 1 PID: 1798 Comm: kfree_scale_thr Not tainted 6.3.0-rc1-rcu+ #1\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015\n    RIP: 0010:0xffffffffc0601a87\n    Code: Unable to access opcode bytes at 0xffffffffc0601a5d.\n    RSP: 0018:ffffb25bc2e57e18 EFLAGS: 00010297\n    RAX: 0000000000000000 RBX: ffffffffc061f0b6 RCX: 0000000000000000\n    RDX: 0000000000000000 RSI: ffffffff962fd0de RDI: ffffffff962fd0de\n    RBP: ffffb25bc2e57ea8 R08: 0000000000000000 R09: 0000000000000000\n    R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000\n    R13: 0000000000000000 R14: 000000000000000a R15: 00000000001c1dbe\n    FS:  0000000000000000(0000) GS:ffff921fa2200000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: ffffffffc0601a5d CR3: 000000011de4c006 CR4: 0000000000370ee0\n    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n    Call Trace:\n     <TASK>\n     ? kvfree_call_rcu+0xf0/0x3a0\n     ? kthread+0xf3/0x120\n     ? kthread_complete_and_exit+0x20/0x20\n     ? ret_from_fork+0x1f/0x30\n     </TASK>\n    Modules linked in: rfkill sunrpc ... [last unloaded: torture]\n    CR2: ffffffffc0601a87\n    ---[ end trace 0000000000000000 ]---"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"604d6a5ff718874904b0fe614878a42b42c0d699","versionType":"git"},{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"f766d45ab294871a3d588ee76c666852f151cad9","versionType":"git"},{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"b8a6ba524d41f4da102e65f90498d9a910839621","versionType":"git"},{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"1dd7547c7610723b2b6afe1a3c4ddb2bde63387c","versionType":"git"},{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"29b1da4f90fc42c91beb4e400d926194925ad31b","versionType":"git"},{"version":"e6e78b004fa7e0ab455d46d27f218bf6ce178a18","status":"affected","lessThan":"23fc8df26dead16687ae6eb47b0561a4a832e2f6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/rcu/rcuscale.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.6","versionType":"semver"},{"version":"5.10.188","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.121","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.39","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.3.13","status":"unaffected","lessThanOrEqual":"6.3.*","versionType":"semver"},{"version":"6.4.4","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/rcu/rcuscale.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/604d6a5ff718874904b0fe614878a42b42c0d699"},{"url":"https://git.kernel.org/stable/c/f766d45ab294871a3d588ee76c666852f151cad9"},{"url":"https://git.kernel.org/stable/c/b8a6ba524d41f4da102e65f90498d9a910839621"},{"url":"https://git.kernel.org/stable/c/1dd7547c7610723b2b6afe1a3c4ddb2bde63387c"},{"url":"https://git.kernel.org/stable/c/29b1da4f90fc42c91beb4e400d926194925ad31b"},{"url":"https://git.kernel.org/stable/c/23fc8df26dead16687ae6eb47b0561a4a832e2f6"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T19:42:07.259Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.10.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.15.121"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.1.39"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.3.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.4.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.5"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2023-53291","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-01-14T18:11:07.607544Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-14T18:12:56.096Z"}}]}}}