HighFix available

pipe: wakeup wr_wait after setting max_usage

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after setting max_usage Commit c73be61cede5 ("pipe: Add general notification queue support") a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in [1]. The commit resizing the pipe ring size was moved to a different function, doing that moved the wakeup for pipe->wr_wait before actually raising pipe->max_usage. If a pipe was full before the resize occured it would result in the wakeup never actually triggering pipe_write. Set @max_usage and @nr_accounted before waking writers if this isn't a watch queue. [Christian Brauner : rewrite to account for watch queues]

Products: Kernel
Affected versions: Not specified
Fixed versions: 5.10.210, 5.15.149, 6.1.76, 6.6.15, 6.7.3
CVEs: CVE-2023-52672
Confirmed fixed CVEs: Not specified
Updated in this feed: 2 Nov 2026, 21:50 UTC · Revision 1

Source evidence

pipe: wakeup wr_wait after setting max_usage

core-osv · Original source

Published 17 May 2024, 14:02 UTC

osv:CVE-2023-52672

Kernel

Fixed versions: 5.10.210, 5.15.149, 6.1.76, 6.6.15, 6.7.3

Complete source record

{
  "id": "e3b07d00f9dd2a7340a36db07f4f3b27458a067e9319cab490429d0e3777c3e8",
  "url": "https://osv.dev/vulnerability/CVE-2023-52672",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "pipe: wakeup wr_wait after setting max_usage",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after setting max_usage Commit c73be61cede5 (\"pipe: Add general notification queue support\") a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in [1]. The commit resizing the pipe ring size was moved to a different function, doing that moved the wakeup for pipe->wr_wait before actually raising pipe->max_usage. If a pipe was full before the resize occured it would result in the wakeup never actually triggering pipe_write. Set @max_usage and @nr_accounted before waking writers if this isn't a watch queue. [Christian Brauner : rewrite to account for watch queues]",
    "evidence": "osv:CVE-2023-52672",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.210",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.149",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.76",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.15",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.7.3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2023-52672",
      "aliases": [
        "CVE-2023-52672"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "c73be61cede5882f9605a852414db559c0ebedfd"
                },
                {
                  "fixed": "162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8"
                },
                {
                  "fixed": "3efbd114b91525bb095b8ae046382197d92126b9"
                },
                {
                  "fixed": "b87a1229d8668fbc78ebd9ca0fc797a76001c60f"
                },
                {
                  "fixed": "68e51bdb1194f11d3452525b99c98aff6f837b24"
                },
                {
                  "fixed": "6fb70694f8d1ac34e45246b0ac988f025e1e5b55"
                },
                {
                  "fixed": "e95aada4cb93d42e25c30a0ef9eb2923d9711d4a"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52672.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.8.0"
                },
                {
                  "fixed": "5.10.210"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.149"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.76"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.15"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.7.3"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52672.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:24.207241192Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8",
        "https://git.kernel.org/stable/c/3efbd114b91525bb095b8ae046382197d92126b9",
        "https://git.kernel.org/stable/c/68e51bdb1194f11d3452525b99c98aff6f837b24",
        "https://git.kernel.org/stable/c/6fb70694f8d1ac34e45246b0ac988f025e1e5b55",
        "https://git.kernel.org/stable/c/b87a1229d8668fbc78ebd9ca0fc797a76001c60f",
        "https://git.kernel.org/stable/c/e95aada4cb93d42e25c30a0ef9eb2923d9711d4a",
        "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52672.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-52672",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52672.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-52672",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 490352,
  "published_at": "2024-05-17T14:02:10.308+00:00"
}