CVE-2023-53671

A synchronization flaw was found in the Linux kernel Sleepable Read-Copy-Update (SRCU) implementation. The subsystem assumed that central processing unit (CPU) 0 was always online. On systems where CPU 0 is offline, such as crash-kernel configurations using a different boot CPU, SRCU work could be queued to a non-existent CPU and hang indefinitely, causing a denial of service.

The problem is not attacker-driven; it is a boot-time topology assumption. SRCU queued synchronization work to CPU 0 even when that CPU was not active. The fix replaces the hard-coded CPU ID with the boot CPU identifier, which is guaranteed to be online, ensuring synchronization work completes properly.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module rcu from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.