CVE-2023-53624

An integer overflow flaw was found in the Linux kernel network fair-queueing scheduler in the way the initial per-flow credit is set. If a configuration provides an excessively large initial quantum, the credit value can overflow to a negative number, leading to excessive scheduling and soft lockups. A local user with permission to configure queueing disciplines could use this flaw to degrade performance or hang the system, resulting in a denial of service.

The fair-queueing scheduler’s “initial quantum” could exceed the supported maximum for a signed integer, causing the first credit assignment to wrap to a large negative value for each new flow. The fix caps the “initial quantum” at the maximum supported value in the policy path so that the credit computation cannot overflow.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module sch_fq from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.