CVE-2023-53730: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53730 is a vulnerability in the Linux kernel's block I/O cost controller (blk-iocost) component, discovered and disclosed on October 22, 2025. The vulnerability affects the adjust_inuse_and_calc_cost function, which incorrectly uses spin_lock_irq() instead of spin_lock_irqsave(), potentially leading to deadlock conditions (NVD, Red Hat).

The vulnerability stems from an improper locking mechanism in the adjust_inuse_and_calc_cost() function. When this function uses spin_lock_irq(), IRQs will be enabled upon unlock, which can cause a DEADLOCK if other locks are held and IRQ is disabled before invoking it. The vulnerability has been assigned a CVSS v3.1 score of 5.5 with attack vector: Local, attack complexity: Low, and privileges required: Low (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (Red Hat).

The vulnerability can lead to system deadlocks when specific locking conditions are met. This occurs particularly when other locks are held and IRQ is disabled before invoking the affected function, potentially causing system availability issues (NVD).

The vulnerability has been resolved by modifying the adjust_inuse_and_calc_cost() function to use spin_lock_irqsave() instead of spin_lock_irq(), which maintains consistent IRQ state before and after the lock operation (NVD).