CVE-2023-53620: md: fix soft lockup in status_resync

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-07 · updated 2026-06-17
Weakness: CWE-667

Description

In the Linux kernel, the following vulnerability has been resolved: md: fix soft lockup in status_resync status_resync() will calculate 'curr_resync - recovery_active' to show user a progress bar like following: [============>........] resync = 61.4% 'curr_resync' and 'recovery_active' is updated in md_do_sync(), and status_resync() can read them concurrently, hence it's possible that 'curr_resync - recovery_active' can overflow to a huge number. In this case status_resync() will be stuck in the loop to print a large amount of '=', which will end up soft lockup. Fix the problem by setting 'resync' to MD_RESYNC_ACTIVE in this case, this way resync in progress will be reported to user.

Affected products

Linux kernel: from 2.6.12.1 before 6.1.30; from 6.2 before 6.3.4; 2.6.12, 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4, 2.6.12-rc5 — fixed in 6.1.30, 6.3.4

How to fix

Upgrade to a fixed version: Linux kernel 6.1.30, 6.3.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53620 or the next vulnerability affects your stack