sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
In the Linux kernel, the following vulnerability has been resolved: sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop With this refcnt added in sctp_stream_priorities, we don't need to traverse all streams to check if the prio is used by other streams when freeing one stream's prio in sctp_sched_prio_free_sid(). This can avoid a nested loop (up to 65535 * 65535), which may cause a stuck as Ying reported: watchdog: BUG: soft lockup - CPU#23 stuck for 26s! [ksoftirqd/23:136] Call Trace: sctp_sched_prio_free_sid+0xab/0x100 [sctp] sctp_stream_free_ext+0x64/0xa0 [sctp] sctp_stream_free+0x31/0x50 [sctp] sctp_association_free+0xa5/0x200 [sctp] Note that it doesn't need to use refcount_t type for this counter, as its accessing is always protected under the sock lock. v1->v2: - add a check in sctp_sched_prio_set to avoid the possible prio_head refcnt overflow.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.173, 5.15.100, 5.4.235, 6.1.18, 6.2.5
- CVEs
- CVE-2023-53590
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 00:25 UTC · Revision 1
Source evidence
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
core-osv · Original sourcePublished 4 Oct 2025, 15:44 UTC
In the Linux kernel, the following vulnerability has been resolved: sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop With this refcnt added in sctp_stream_priorities, we don't need to traverse all streams to check if the prio is used by other streams when freeing one stream's prio in sctp_sched_prio_free_sid(). This can avoid a nested loop (up to 65535 * 65535), which may cause a stuck as Ying reported: watchdog: BUG: soft lockup - CPU#23 stuck for 26s! [ksoftirqd/23:136] Call Trace: sctp_sched_prio_free_sid+0xab/0x100 [sctp] sctp_stream_free_ext+0x64/0xa0 [sctp] sctp_stream_free+0x31/0x50 [sctp] sctp_association_free+0xa5/0x200 [sctp] Note that it doesn't need to use refcount_t type for this counter, as its accessing is always protected under the sock lock. v1->v2: - add a check in sctp_sched_prio_set to avoid the possible prio_head refcnt overflow.
osv:CVE-2023-53590
Kernel
Fixed versions: 5.4.235, 5.10.173, 5.15.100, 6.1.18, 6.2.5
Complete source record
{
"id": "2bb75bbb023b3b8b05c119ccf41a2ecef6ef6f4976e5c67f123d72709555e899",
"url": "https://osv.dev/vulnerability/CVE-2023-53590",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop",
"summary": "In the Linux kernel, the following vulnerability has been resolved: sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop With this refcnt added in sctp_stream_priorities, we don't need to traverse all streams to check if the prio is used by other streams when freeing one stream's prio in sctp_sched_prio_free_sid(). This can avoid a nested loop (up to 65535 * 65535), which may cause a stuck as Ying reported: watchdog: BUG: soft lockup - CPU#23 stuck for 26s! [ksoftirqd/23:136] Call Trace: sctp_sched_prio_free_sid+0xab/0x100 [sctp] sctp_stream_free_ext+0x64/0xa0 [sctp] sctp_stream_free+0x31/0x50 [sctp] sctp_association_free+0xa5/0x200 [sctp] Note that it doesn't need to use refcount_t type for this counter, as its accessing is always protected under the sock lock. v1->v2: - add a check in sctp_sched_prio_set to avoid the possible prio_head refcnt overflow.",
"evidence": "osv:CVE-2023-53590",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.235",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.173",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.100",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.18",
"evidence": "/affected/1/ranges"
},
{
"value": "6.2.5",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2023-53590",
"aliases": [
"CVE-2023-53590"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a7555681e50bdebed2c40ff7404ee73c2e932993"
},
{
"fixed": "cec326443f01283ef68ea00c06ea073b1835a562"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "176ee6c673ccd118e9392fd2dbb165423bdb99ca"
},
{
"fixed": "8ee401f89cdb10f39098c0656d695b2bc4052100"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "0dfb9a566327182387c90100ea54d8426cee8c67"
},
{
"fixed": "bf5540cbd20e2dae2c81ab9b31deef41ef147d0a"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9"
},
{
"fixed": "03c3a5584a0a29821e59b7834635ce823050caaa"
},
{
"fixed": "6d529928ea212127851a2df8c40d822237ca946b"
},
{
"fixed": "68ba44639537de6f91fe32783766322d41848127"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.4.226"
},
{
"fixed": "5.4.235"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.158"
},
{
"fixed": "5.10.173"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.82"
},
{
"fixed": "5.15.100"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.0.12"
},
{
"fixed": "6.1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "fa20f88271259d42ebe66f0a8c4c20199e888c99"
}
]
}
],
"versions": [
"v5.4.234",
"v5.4.233",
"v5.4.232",
"v5.4.231",
"v5.4.230",
"v5.4.229",
"v5.4.228",
"v5.4.227",
"v5.4.226",
"v5.10.172",
"v5.10.171",
"v5.10.170",
"v5.10.169",
"v5.10.168",
"v5.10.167",
"v5.10.166",
"v5.10.165",
"v5.10.164",
"v5.10.163",
"v5.10.162",
"v5.10.161",
"v5.10.160",
"v5.10.159",
"v5.10.158",
"v5.15.99",
"v5.15.98",
"v5.15.97",
"v5.15.96",
"v5.15.95",
"v5.15.94",
"v5.15.93",
"v5.15.92",
"v5.15.91",
"v5.15.90",
"v5.15.89",
"v5.15.88",
"v5.15.87",
"v5.15.86",
"v5.15.85",
"v5.15.84",
"v5.15.83",
"v5.15.82",
"v6.0.19",
"v6.0.18",
"v6.0.17",
"v6.0.16",
"v6.0.15",
"v6.0.14",
"v6.0.13",
"v6.0.12"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53590.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.4.235"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.173"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.100"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.18"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.2.5"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53590.json"
}
}
],
"modified": "2026-10-28T02:30:32.640643228Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/03c3a5584a0a29821e59b7834635ce823050caaa",
"https://git.kernel.org/stable/c/68ba44639537de6f91fe32783766322d41848127",
"https://git.kernel.org/stable/c/6d529928ea212127851a2df8c40d822237ca946b",
"https://git.kernel.org/stable/c/8ee401f89cdb10f39098c0656d695b2bc4052100",
"https://git.kernel.org/stable/c/bf5540cbd20e2dae2c81ab9b31deef41ef147d0a",
"https://git.kernel.org/stable/c/cec326443f01283ef68ea00c06ea073b1835a562",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53590.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-53590",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53590.json"
}
},
"related_cves": [
{
"value": "CVE-2023-53590",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 499333,
"published_at": "2025-10-04T15:44:04.733+00:00"
}