{
  "threat_severity" : "Low",
  "public_date" : "2025-10-07T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: drivers/perf: hisi: Don't migrate perf to the CPU going to teardown",
    "id" : "2402196",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2402196"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.4",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-367",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\ndrivers/perf: hisi: Don't migrate perf to the CPU going to teardown\nThe driver needs to migrate the perf context if the current using CPU going\nto teardown. By the time calling the cpuhp::teardown() callback the\ncpu_online_mask() hasn't updated yet and still includes the CPU going to\nteardown. In current driver's implementation we may migrate the context\nto the teardown CPU and leads to the below calltrace:\n...\n[  368.104662][  T932] task:cpuhp/0         state:D stack:    0 pid:   15 ppid:     2 flags:0x00000008\n[  368.113699][  T932] Call trace:\n[  368.116834][  T932]  __switch_to+0x7c/0xbc\n[  368.120924][  T932]  __schedule+0x338/0x6f0\n[  368.125098][  T932]  schedule+0x50/0xe0\n[  368.128926][  T932]  schedule_preempt_disabled+0x18/0x24\n[  368.134229][  T932]  __mutex_lock.constprop.0+0x1d4/0x5dc\n[  368.139617][  T932]  __mutex_lock_slowpath+0x1c/0x30\n[  368.144573][  T932]  mutex_lock+0x50/0x60\n[  368.148579][  T932]  perf_pmu_migrate_context+0x84/0x2b0\n[  368.153884][  T932]  hisi_pcie_pmu_offline_cpu+0x90/0xe0 [hisi_pcie_pmu]\n[  368.160579][  T932]  cpuhp_invoke_callback+0x2a0/0x650\n[  368.165707][  T932]  cpuhp_thread_fun+0xe4/0x190\n[  368.170316][  T932]  smpboot_thread_fn+0x15c/0x1a0\n[  368.175099][  T932]  kthread+0x108/0x13c\n[  368.179012][  T932]  ret_from_fork+0x10/0x18\n...\nUse function cpumask_any_but() to find one correct active cpu to fixes\nthis issue.", "A logic error was found in the Linux kernel's HiSilicon PCIe performance monitoring driver in the CPU offline handling path. \nA local user can trigger this issue during CPU hotplug operations when the driver migrates performance monitoring context, potentially selecting the CPU being torn down as the migration target. This causes deadlock when the migration code attempts to use a CPU that is no longer operational, resulting in hung tasks and denial of service through system unresponsiveness." ],
  "statement" : "The hisi_pcie_pmu_offline_cpu function is called during CPU hotplug teardown to migrate the perf context away from the offline CPU. However, the function uses cpumask_any_online which consults cpu_online_mask before it has been updated to exclude the teardown CPU. This creates a race where the function may select the very CPU being torn down as the migration destination. When perf_pmu_migrate_context subsequently attempts operations on this dying CPU, it encounters locks and resources that are no longer valid, causing the task to hang indefinitely in an uninterruptible sleep state.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-11-07T00:00:00Z",
    "advisory" : "RHSA-2023:6583",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-362.8.1.el9_3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-11-07T00:00:00Z",
    "advisory" : "RHSA-2023:6583",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-362.8.1.el9_3"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-53656\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53656\nhttps://lore.kernel.org/linux-cve-announce/2025100701-CVE-2023-53656-1a7b@gregkh/T" ],
  "name" : "CVE-2023-53656",
  "csaw" : false
}