GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53169 (GCVE-0-2023-53169)

Vulnerability from cvelistv5 – Published: 2025-09-15 14:04 – Updated: 2026-05-11 19:39
VLAI
Title
x86/resctrl: Clear staged_config[] before and after it is used
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Clear staged_config[] before and after it is used As a temporary storage, staged_config[] in rdt_domain should be cleared before and after it is used. The stale value in staged_config[] could cause an MSR access error. Here is a reproducer on a system with 16 usable CLOSIDs for a 15-way L3 Cache (MBA should be disabled if the number of CLOSIDs for MB is less than 16.) : mount -t resctrl resctrl -o cdp /sys/fs/resctrl mkdir /sys/fs/resctrl/p{1..7} umount /sys/fs/resctrl/ mount -t resctrl resctrl /sys/fs/resctrl mkdir /sys/fs/resctrl/p{1..8} An error occurs when creating resource group named p8: unchecked MSR access error: WRMSR to 0xca0 (tried to write 0x00000000000007ff) at rIP: 0xffffffff82249142 (cat_wrmsr+0x32/0x60) Call Trace: <IRQ> __flush_smp_call_function_queue+0x11d/0x170 __sysvec_call_function+0x24/0xd0 sysvec_call_function+0x89/0xc0 </IRQ> <TASK> asm_sysvec_call_function+0x16/0x20 When creating a new resource control group, hardware will be configured by the following process: rdtgroup_mkdir() rdtgroup_mkdir_ctrl_mon() rdtgroup_init_alloc() resctrl_arch_update_domains() resctrl_arch_update_domains() iterates and updates all resctrl_conf_type whose have_new_ctrl is true. Since staged_config[] holds the same values as when CDP was enabled, it will continue to update the CDP_CODE and CDP_DATA configurations. When group p8 is created, get_config_index() called in resctrl_arch_update_domains() will return 16 and 17 as the CLOSIDs for CDP_CODE and CDP_DATA, which will be translated to an invalid register - 0xca0 in this scenario. Fix it by clearing staged_config[] before and after it is used. [reinette: re-order commit tags]
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 75408e43509ed6207870c0e7e28656acbbc1f7fd , < 86db319d25db70cf4af4557e05f6fa6f39c70003 (git)
Affected: 75408e43509ed6207870c0e7e28656acbbc1f7fd , < 3fc5941ecc31a495b6b84b465f36155009db99b5 (git)
Affected: 75408e43509ed6207870c0e7e28656acbbc1f7fd , < 8ecc60ef9318f0d533b866fa421858cc185bccfc (git)
Affected: 75408e43509ed6207870c0e7e28656acbbc1f7fd , < 0424a7dfe9129b93f29b277511a60e87f052ac6b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.104 , ≤ 5.15.* (semver)
Unaffected: 6.1.21 , ≤ 6.1.* (semver)
Unaffected: 6.2.8 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/resctrl/ctrlmondata.c",
            "arch/x86/kernel/cpu/resctrl/internal.h",
            "arch/x86/kernel/cpu/resctrl/rdtgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86db319d25db70cf4af4557e05f6fa6f39c70003",
              "status": "affected",
              "version": "75408e43509ed6207870c0e7e28656acbbc1f7fd",
              "versionType": "git"
            },
            {
              "lessThan": "3fc5941ecc31a495b6b84b465f36155009db99b5",
              "status": "affected",
              "version": "75408e43509ed6207870c0e7e28656acbbc1f7fd",
              "versionType": "git"
            },
            {
              "lessThan": "8ecc60ef9318f0d533b866fa421858cc185bccfc",
              "status": "affected",
              "version": "75408e43509ed6207870c0e7e28656acbbc1f7fd",
              "versionType": "git"
            },
            {
              "lessThan": "0424a7dfe9129b93f29b277511a60e87f052ac6b",
              "status": "affected",
              "version": "75408e43509ed6207870c0e7e28656acbbc1f7fd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/resctrl/ctrlmondata.c",
            "arch/x86/kernel/cpu/resctrl/internal.h",
            "arch/x86/kernel/cpu/resctrl/rdtgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.104",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.21",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/resctrl: Clear staged_config[] before and after it is used\n\nAs a temporary storage, staged_config[] in rdt_domain should be cleared\nbefore and after it is used. The stale value in staged_config[] could\ncause an MSR access error.\n\nHere is a reproducer on a system with 16 usable CLOSIDs for a 15-way L3\nCache (MBA should be disabled if the number of CLOSIDs for MB is less than\n16.) :\n\tmount -t resctrl resctrl -o cdp /sys/fs/resctrl\n\tmkdir /sys/fs/resctrl/p{1..7}\n\tumount /sys/fs/resctrl/\n\tmount -t resctrl resctrl /sys/fs/resctrl\n\tmkdir /sys/fs/resctrl/p{1..8}\n\nAn error occurs when creating resource group named p8:\n    unchecked MSR access error: WRMSR to 0xca0 (tried to write 0x00000000000007ff) at rIP: 0xffffffff82249142 (cat_wrmsr+0x32/0x60)\n    Call Trace:\n     \u003cIRQ\u003e\n     __flush_smp_call_function_queue+0x11d/0x170\n     __sysvec_call_function+0x24/0xd0\n     sysvec_call_function+0x89/0xc0\n     \u003c/IRQ\u003e\n     \u003cTASK\u003e\n     asm_sysvec_call_function+0x16/0x20\n\nWhen creating a new resource control group, hardware will be configured\nby the following process:\n    rdtgroup_mkdir()\n      rdtgroup_mkdir_ctrl_mon()\n        rdtgroup_init_alloc()\n          resctrl_arch_update_domains()\n\nresctrl_arch_update_domains() iterates and updates all resctrl_conf_type\nwhose have_new_ctrl is true. Since staged_config[] holds the same values as\nwhen CDP was enabled, it will continue to update the CDP_CODE and CDP_DATA\nconfigurations. When group p8 is created, get_config_index() called in\nresctrl_arch_update_domains() will return 16 and 17 as the CLOSIDs for\nCDP_CODE and CDP_DATA, which will be translated to an invalid register -\n0xca0 in this scenario.\n\nFix it by clearing staged_config[] before and after it is used.\n\n[reinette: re-order commit tags]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:39:36.360Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86db319d25db70cf4af4557e05f6fa6f39c70003"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fc5941ecc31a495b6b84b465f36155009db99b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ecc60ef9318f0d533b866fa421858cc185bccfc"
        },
        {
          "url": "https://git.kernel.org/stable/c/0424a7dfe9129b93f29b277511a60e87f052ac6b"
        }
      ],
      "title": "x86/resctrl: Clear staged_config[] before and after it is used",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53169",
    "datePublished": "2025-09-15T14:04:02.395Z",
    "dateReserved": "2025-09-15T13:59:19.063Z",
    "dateUpdated": "2026-05-11T19:39:36.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53169",
      "date": "2026-09-15",
      "epss": "0.00155",
      "percentile": "0.05002"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53169\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-15T14:15:38.693\",\"lastModified\":\"2026-06-17T06:44:25.870\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/resctrl: Clear staged_config[] before and after it is used\\n\\nAs a temporary storage, staged_config[] in rdt_domain should be cleared\\nbefore and after it is used. The stale value in staged_config[] could\\ncause an MSR access error.\\n\\nHere is a reproducer on a system with 16 usable CLOSIDs for a 15-way L3\\nCache (MBA should be disabled if the number of CLOSIDs for MB is less than\\n16.) :\\n\\tmount -t resctrl resctrl -o cdp /sys/fs/resctrl\\n\\tmkdir /sys/fs/resctrl/p{1..7}\\n\\tumount /sys/fs/resctrl/\\n\\tmount -t resctrl resctrl /sys/fs/resctrl\\n\\tmkdir /sys/fs/resctrl/p{1..8}\\n\\nAn error occurs when creating resource group named p8:\\n    unchecked MSR access error: WRMSR to 0xca0 (tried to write 0x00000000000007ff) at rIP: 0xffffffff82249142 (cat_wrmsr+0x32/0x60)\\n    Call Trace:\\n     \u003cIRQ\u003e\\n     __flush_smp_call_function_queue+0x11d/0x170\\n     __sysvec_call_function+0x24/0xd0\\n     sysvec_call_function+0x89/0xc0\\n     \u003c/IRQ\u003e\\n     \u003cTASK\u003e\\n     asm_sysvec_call_function+0x16/0x20\\n\\nWhen creating a new resource control group, hardware will be configured\\nby the following process:\\n    rdtgroup_mkdir()\\n      rdtgroup_mkdir_ctrl_mon()\\n        rdtgroup_init_alloc()\\n          resctrl_arch_update_domains()\\n\\nresctrl_arch_update_domains() iterates and updates all resctrl_conf_type\\nwhose have_new_ctrl is true. Since staged_config[] holds the same values as\\nwhen CDP was enabled, it will continue to update the CDP_CODE and CDP_DATA\\nconfigurations. When group p8 is created, get_config_index() called in\\nresctrl_arch_update_domains() will return 16 and 17 as the CLOSIDs for\\nCDP_CODE and CDP_DATA, which will be translated to an invalid register -\\n0xca0 in this scenario.\\n\\nFix it by clearing staged_config[] before and after it is used.\\n\\n[reinette: re-order commit tags]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kernel/cpu/resctrl/ctrlmondata.c\",\"arch/x86/kernel/cpu/resctrl/internal.h\",\"arch/x86/kernel/cpu/resctrl/rdtgroup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"75408e43509ed6207870c0e7e28656acbbc1f7fd\",\"lessThan\":\"86db319d25db70cf4af4557e05f6fa6f39c70003\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"75408e43509ed6207870c0e7e28656acbbc1f7fd\",\"lessThan\":\"3fc5941ecc31a495b6b84b465f36155009db99b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"75408e43509ed6207870c0e7e28656acbbc1f7fd\",\"lessThan\":\"8ecc60ef9318f0d533b866fa421858cc185bccfc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"75408e43509ed6207870c0e7e28656acbbc1f7fd\",\"lessThan\":\"0424a7dfe9129b93f29b277511a60e87f052ac6b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kernel/cpu/resctrl/ctrlmondata.c\",\"arch/x86/kernel/cpu/resctrl/internal.h\",\"arch/x86/kernel/cpu/resctrl/rdtgroup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.104\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.21\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.8\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.104\",\"matchCriteriaId\":\"D70CE96A-7C20-4A64-9A02-5282F973E379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.21\",\"matchCriteriaId\":\"1F1CA6A9-8F4D-408D-9116-868EC067DCD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.2.8\",\"matchCriteriaId\":\"4011EC6B-7786-4709-B765-186FA31D6F7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8E3B0E8-FA27-4305-87BB-AF6C25B160CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A47F0FC3-CE52-4BA1-BA51-22F783938431\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0424a7dfe9129b93f29b277511a60e87f052ac6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3fc5941ecc31a495b6b84b465f36155009db99b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/86db319d25db70cf4af4557e05f6fa6f39c70003\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ecc60ef9318f0d533b866fa421858cc185bccfc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T22:12:47+00:00",
      "cve": "CVE-2023-53169",
      "id": "CVE-2023-53169",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: x86/resctrl: Clear staged_config[] before and after it is used",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53169.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:16:34Z",
      "cve": "CVE-2023-53169",
      "id": "CVE-2023-53169",
      "initial_release_date": "2025-09-17T23:29:48Z",
      "product_status:known_not_affected": "523",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53169",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53169.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.