CVE-2023-53986: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-53986 is a vulnerability in the Linux kernel affecting the MIPS BMIPS platform, specifically the BCM6358 SoC. The issue involves the Read-Ahead Cache (RAC) flush mechanism causing kernel panics when booting from Thread Processor 1 (TP1) in the presence of EHCI/OHCI USB hardware. It was published on December 24, 2025, and affects Linux kernel versions prior to the fix. The CVSS category is estimated as Medium, with an EPSS score of 0.000240 (Feedly).

The root cause is an improper handling of the RAC (Read-Ahead Cache) flush operation in the MIPS BMIPS BCM6358 platform code when the kernel is booted from TP1 (Thread Processor 1). When EHCI or OHCI USB drivers are loaded, the RAC flush triggers a "Reserved instruction" exception (ExcCode 0a) in kernel code at setup_sigcontext+0x54/0x24c, resulting in a kernel panic. The fix disables the RAC flush for TP1 on BCM6358 to prevent this illegal instruction fault. This is classified as an availability issue (CWE-703 or similar improper exception handling) rather than a code execution or privilege escalation vulnerability (Feedly).

The primary impact of this vulnerability is a denial of service — specifically, a kernel panic that crashes the system during boot when USB (EHCI/OHCI) devices are present and the kernel is booted from TP1 on BCM6358-based MIPS devices. There is no known confidentiality or integrity impact; the vulnerability is limited to availability of the affected embedded system. Affected devices running vulnerable Linux kernel versions on BCM6358 hardware may be rendered unbootable or unstable (Feedly).

This vulnerability is not remotely exploitable — it is triggered locally during the kernel boot process on specific BCM6358 MIPS hardware with USB peripherals attached. There is no known public exploit code, no evidence of in-the-wild exploitation, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at 0.000240, reflecting minimal exploitation probability (Feedly).

The fix is to disable the RAC flush for TP1 in the BCM6358 BMIPS platform code, which has been applied to the Linux kernel stable tree via multiple commits (e.g., 2cdbcff99f15, 47a449ec09b4, 65b723644294, 288c96aa5b55, ab327f8acdf8). Users running affected BCM6358-based MIPS devices should update to a patched kernel version that includes these fixes. As a workaround, booting from TP0 instead of TP1 may avoid the issue, though upgrading the kernel is the recommended solution (Feedly).