{"id":"DEBIAN-CVE-2023-53233","details":"In the Linux kernel, the following vulnerability has been resolved:  net/smc: fix deadlock triggered by cancel_delayed_work_syn()  The following LOCKDEP was detected: \t\tWorkqueue: events smc_lgr_free_work [smc] \t\tWARNING: possible circular locking dependency detected \t\t6.1.0-20221027.rc2.git8.56bc5b569087.300.fc36.s390x+debug #1 Not tainted \t\t------------------------------------------------------ \t\tkworker/3:0/176251 is trying to acquire lock: \t\t00000000f1467148 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0}, \t\t\tat: __flush_workqueue+0x7a/0x4f0 \t\tbut task is already holding lock: \t\t0000037fffe97dc8 ((work_completion)(&(&lgr-\u003efree_work)-\u003ework)){+.+.}-{0:0}, \t\t\tat: process_one_work+0x232/0x730 \t\twhich lock already depends on the new lock. \t\tthe existing dependency chain (in reverse order) is: \t\t-\u003e #4 ((work_completion)(&(&lgr-\u003efree_work)-\u003ework)){+.+.}-{0:0}: \t\t       __lock_acquire+0x58e/0xbd8 \t\t       lock_acquire.part.0+0xe2/0x248 \t\t       lock_acquire+0xac/0x1c8 \t\t       __flush_work+0x76/0xf0 \t\t       __cancel_work_timer+0x170/0x220 \t\t       __smc_lgr_terminate.part.0+0x34/0x1c0 [smc] \t\t       smc_connect_rdma+0x15e/0x418 [smc] \t\t       __smc_connect+0x234/0x480 [smc] \t\t       smc_connect+0x1d6/0x230 [smc] \t\t       __sys_connect+0x90/0xc0 \t\t       __do_sys_socketcall+0x186/0x370 \t\t       __do_syscall+0x1da/0x208 \t\t       system_call+0x82/0xb0 \t\t-\u003e #3 (smc_client_lgr_pending){+.+.}-{3:3}: \t\t       __lock_acquire+0x58e/0xbd8 \t\t       lock_acquire.part.0+0xe2/0x248 \t\t       lock_acquire+0xac/0x1c8 \t\t       __mutex_lock+0x96/0x8e8 \t\t       mutex_lock_nested+0x32/0x40 \t\t       smc_connect_rdma+0xa4/0x418 [smc] \t\t       __smc_connect+0x234/0x480 [smc] \t\t       smc_connect+0x1d6/0x230 [smc] \t\t       __sys_connect+0x90/0xc0 \t\t       __do_sys_socketcall+0x186/0x370 \t\t       __do_syscall+0x1da/0x208 \t\t       system_call+0x82/0xb0 \t\t-\u003e #2 (sk_lock-AF_SMC){+.+.}-{0:0}: \t\t       __lock_acquire+0x58e/0xbd8 \t\t       lock_acquire.part.0+0xe2/0x248 \t\t       lock_acquire+0xac/0x1c8 \t\t       lock_sock_nested+0x46/0xa8 \t\t       smc_tx_work+0x34/0x50 [smc] \t\t       process_one_work+0x30c/0x730 \t\t       worker_thread+0x62/0x420 \t\t       kthread+0x138/0x150 \t\t       __ret_from_fork+0x3c/0x58 \t\t       ret_from_fork+0xa/0x40 \t\t-\u003e #1 ((work_completion)(&(&smc-\u003econn.tx_work)-\u003ework)){+.+.}-{0:0}: \t\t       __lock_acquire+0x58e/0xbd8 \t\t       lock_acquire.part.0+0xe2/0x248 \t\t       lock_acquire+0xac/0x1c8 \t\t       process_one_work+0x2bc/0x730 \t\t       worker_thread+0x62/0x420 \t\t       kthread+0x138/0x150 \t\t       __ret_from_fork+0x3c/0x58 \t\t       ret_from_fork+0xa/0x40 \t\t-\u003e #0 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0}: \t\t       check_prev_add+0xd8/0xe88 \t\t       validate_chain+0x70c/0xb20 \t\t       __lock_acquire+0x58e/0xbd8 \t\t       lock_acquire.part.0+0xe2/0x248 \t\t       lock_acquire+0xac/0x1c8 \t\t       __flush_workqueue+0xaa/0x4f0 \t\t       drain_workqueue+0xaa/0x158 \t\t       destroy_workqueue+0x44/0x2d8 \t\t       smc_lgr_free+0x9e/0xf8 [smc] \t\t       process_one_work+0x30c/0x730 \t\t       worker_thread+0x62/0x420 \t\t       kthread+0x138/0x150 \t\t       __ret_from_fork+0x3c/0x58 \t\t       ret_from_fork+0xa/0x40 \t\tother info that might help us debug this: \t\tChain exists of: \t\t  (wq_completion)smc_tx_wq-00000000#2 \t  \t  --\u003e smc_client_lgr_pending \t\t  --\u003e (work_completion)(&(&lgr-\u003efree_work)-\u003ework) \t\t Possible unsafe locking scenario: \t\t       CPU0                    CPU1 \t\t       ----                    ---- \t\t  lock((work_completion)(&(&lgr-\u003efree_work)-\u003ework)); \t\t                   lock(smc_client_lgr_pending); \t\t                   lock((work_completion) \t\t\t\t\t(&(&lgr-\u003efree_work)-\u003ework)); \t\t  lock((wq_completion)smc_tx_wq-00000000#2); \t\t *** DEADLOCK *** \t\t2 locks held by kworker/3:0/176251: \t\t #0: 0000000080183548 \t\t\t((wq_completion)events){+.+.}-{0:0}, \t\t\t\tat: process_one_work+0x232/0x730 \t\t #1: 0000037fffe97dc8 \t\t\t((work_completion) \t\t\t (&(&lgr-\u003efree_work)-\u003ework)){+.+.}-{0:0}, \t\t\t\tat: process_one_work+0x232/0x730 \t\tstack backtr ---truncated---","modified":"2026-09-15T09:03:02.623136243Z","published":"2025-09-15T15:15:50.297Z","upstream":["CVE-2023-53233"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53233"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53233.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53233.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53233.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}