CVE-2023-53790: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53790 is a vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) memory allocator that can lead to a hard-lockup condition. The flaw exists in the non-preallocated hash table (htab) map path, where freed elements in the BPF memory allocator may be immediately reused without proper zeroing, causing concurrent lookup procedures to access uninitialized or reinitialized special fields (e.g., bpf_spin_lock) in map values. Affected Linux kernel versions include those from commit 0fd7c5d43339b783ee3301a05f925d1e52ac87c9 up to the fixes introduced in kernel 6.1.16, 6.2.3, and 6.3. The vulnerability was published on December 9, 2025, with an estimated CVSS severity of Medium and an EPSS score of 0.017% (Feedly, ENISA EUVD).

The root cause is a use-before-initialization condition (related to CWE-908: Use of Uninitialized Resource) in the Linux kernel's BPF slab memory allocator. When a non-preallocated htab map element is freed and immediately reallocated, the BPF memory allocator does not zero the memory before reuse. The reinitialization of special fields like bpf_spin_lock in the map value occurs during element insertion, but a concurrent lookup can access these fields before reinitialization completes, triggering a queued_spin_lock_slowpath hard-lockup. The fix applies __GFP_ZERO semantics to the non-preallocated htab path in the BPF memory allocator, mirroring the behavior already used for preallocated htab maps via bpf_map_area_alloc(); per-CPU allocations are unaffected as __alloc_percpu_gfp() already zeroes memory implicitly (Feedly, Kernel Patch 6.1, Kernel Patch 6.2, Kernel Patch 6.3).

Successful triggering of this vulnerability results in a kernel hard-lockup (system hang/denial of service), as demonstrated by the NMI backtrace showing CPU 16 stuck in queued_spin_lock_slowpath during a BPF map lookup. The impact is primarily an availability concern — an attacker or unprivileged user with access to BPF syscalls could cause the affected system to become unresponsive, requiring a reboot. There is no direct evidence of confidentiality or integrity impact beyond the system crash (Feedly).

There are no known public exploits, exploit kits, or reports of in-the-wild exploitation for CVE-2023-53790. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to invoke BPF syscalls, which typically requires elevated privileges or specific kernel configurations allowing unprivileged BPF (Feedly).

The Linux kernel project has released patches addressing this vulnerability in stable branches: kernel 6.1.16 (commit 678ea18d), kernel 6.2.3 (commit 5d447e04), and kernel 6.3 (commit 997849c4). Users should update their Linux kernel to one of these patched versions or later. As a workaround, restricting unprivileged access to BPF syscalls (e.g., setting kernel.unprivileged_bpf_disabled=1 via sysctl) can reduce the attack surface on systems where kernel updates cannot be applied immediately (Kernel Patch 6.1, Kernel Patch 6.2, Kernel Patch 6.3).