CVE-2023-54306

HighCVSS 7.5/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: tls: avoid hanging tasks on the tx_lock

syzbot sent a hung task report and Eric explains that adversarial receiver may keep RWIN at 0 for a long time, so we are not guaranteed to make forward progress. Thread which took tx_lock and went to sleep may not release tx_lock for hours. Use interruptible sleep where possible and reschedule the work if it can't take the lock.

Testing: existing selftest passes

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 79ffe6087e9145d2377385cac48d0d6a6b4225a5, < bde541a57b4204d0a800afbbd3d1c06c9cdb133f; >= 79ffe6087e9145d2377385cac48d0d6a6b4225a5, < 7123a4337bf73132bbfb5437e4dc83ba864a9a1e; >= 79ffe6087e9145d2377385cac48d0d6a6b4225a5, < be5d5d0637fd88c18ee76024bdb22649a1de00d6; >= 79ffe6087e9145d2377385cac48d0d6a6b4225a5, < 1f800f6aae57d2d8f63d32fff383017cbc11cf65; >= 79ffe6087e9145d2377385cac48d0d6a6b4225a5, < ccf1ccdc5926907befbe880b562b2a4b5f44c087; >= 79ffe6087e9145d2377385cac48d0d6a6b4225a5, < f3221361dc85d4de22586ce8441ec2c67b454f5d; c8d6817345f4ba228d07380e571676405e112872; >= 5.3.11, < 5.4
LinuxLinux5.4

References

Timeline

Published
Dec 30, 2025
Last modified
Oct 15, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-54307In the Linux kernel, the following vulnerability has been resolved: ptp_qoriq: fix memory leak in probe() Smatch complains that: drivers/pCVE-2023-543087.8In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Create card with device-managed snd_devm_card_new() snd_CVE-2023-54309In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation /dev/CVE-2023-54316.5The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, andCVE-2023-543107.8In the Linux kernel, the following vulnerability has been resolved: scsi: message: mptlan: Fix use after free bug in mptlan_remove() due toCVE-2023-54311In the Linux kernel, the following vulnerability has been resolved: ext4: fix deadlock when converting an inline directory in nojournal modCVE-2023-54312In the Linux kernel, the following vulnerability has been resolved: samples/bpf: Fix buffer overflow in tcp_basertt Using sizeof(nv) or stCVE-2023-54313In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovl_get_acl_rcu() Following proceCVE-2023-54314In the Linux kernel, the following vulnerability has been resolved: media: af9005: Fix null-ptr-deref in af9005_i2c_xfer In af9005_i2c_xfeCVE-2023-54315In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv/sriov: perform null check on iov before dereferencing iCVE-2023-54316In the Linux kernel, the following vulnerability has been resolved: refscale: Fix uninitalized use of wait_queue_head_t Running the refscaCVE-2023-543177.8In the Linux kernel, the following vulnerability has been resolved: dm flakey: don't corrupt the zero page When we need to zero some range
CVE-2023-54306: High severity, CVSS 7.5 | Vulnix