CVE-2023-52672

MEDIUM
Published May 17, 2024 Modified Dec 23, 2025 CWE-400

Description

In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after setting max_usage Commit c73be61cede5 ("pipe: Add general notification queue support") a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in [1]. The commit resizing the pipe ring size was moved to a different function, doing that moved the wakeup for pipe->wr_wait before actually raising pipe->max_usage. If a pipe was full before the resize occured it would result in the wakeup never actually triggering pipe_write. Set @max_usage and @nr_accounted before waking writers if this isn't a watch queue. [Christian Brauner <[email protected]>: rewrite to account for watch queues]

Is your site exposed to CVE-2023-52672?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-400 Uncontrolled Resource Consumption

Affected Products

Vendor Product
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
debian debian_linux

References

Advisories & Patches

https://git.kernel.org/stable/c/162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8 https://git.kernel.org/stable/c/3efbd114b91525bb095b8ae046382197d92126b9 https://git.kernel.org/stable/c/68e51bdb1194f11d3452525b99c98aff6f837b24 https://git.kernel.org/stable/c/6fb70694f8d1ac34e45246b0ac988f025e1e5b55 https://git.kernel.org/stable/c/b87a1229d8668fbc78ebd9ca0fc797a76001c60f https://git.kernel.org/stable/c/e95aada4cb93d42e25c30a0ef9eb2923d9711d4a https://git.kernel.org/stable/c/162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8 https://git.kernel.org/stable/c/3efbd114b91525bb095b8ae046382197d92126b9 https://git.kernel.org/stable/c/68e51bdb1194f11d3452525b99c98aff6f837b24 https://git.kernel.org/stable/c/6fb70694f8d1ac34e45246b0ac988f025e1e5b55 https://git.kernel.org/stable/c/b87a1229d8668fbc78ebd9ca0fc797a76001c60f https://git.kernel.org/stable/c/e95aada4cb93d42e25c30a0ef9eb2923d9711d4a

Frequently Asked Questions

What is CVE-2023-52672? +
In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after setting max_usage Commit c73be61cede5 ("pipe: Add general notification queue support") a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in [1]. The commit resizing the pipe ring size was moved to a different function, doing that moved the wakeup for pipe->wr_wait before actually raising pipe->max_usage. If a pipe was full before the resize occured it would result in the wakeup never actually triggering pipe_write. Set @max_usage and @nr_accounted before waking writers if this isn't a watch queue. [Christian Brauner <[email protected]>: rewrite to account for watch queues] It has a CVSS v3.1 base score of 5.5 (MEDIUM).
How severe is CVE-2023-52672? +
CVE-2023-52672 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2023-52672? +
CVE-2023-52672 affects products from debian, linux, specifically: debian_linux, linux_kernel. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2023-52672? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-45802

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates …
CVE-2026-67318

axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are …
CVE-2026-42343

FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation …
CVE-2025-41361

Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, …
CVE-2025-41360

Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The device is vulnerable to a packet flooding denial of …
CVE-2024-5422

An uncontrolled resource consumption of file descriptors in SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 allows …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2023-52672 — free, no signup required.