CVE-2023-53577

A race condition was found in the Linux kernel's BPF cpumap implementation in the kthread lifecycle management. A local user can trigger this issue by running XDP redirect operations when the per-CPU kthread is stopped prematurely before processing queued frames, causing the cleanup code to find a non-empty ptr_ring and report warnings. This results in kernel warnings and denial of service through system instability.

The cpumap uses per-CPU kthreads to process XDP redirected packets. When a CPU map entry is being removed, kthread_stop is called which can return -EINTR if the thread hasn't fully started yet. Meanwhile, XDP programs may have already queued frames into the ptr_ring. The __cpu_map_ring_cleanup function expects the ring to be empty when called, but with the prematurely stopped kthread, queued frames remain unprocessed. This creates a state where frames were correctly handled by the XDP program but never consumed by the kthread, leading to warnings about non-empty rings. The fix ensures the kthread is fully running before allowing map updates to complete, preventing the race.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.