CVE-2023-53281

drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler()

State: Published
Severity: 5.5 Medium
Published: Sep 16, 2025
Updated: May 23, 2026
Reserved: Sep 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler()

Commit 041879b12ddb ("drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()") besides fixing the deadlock also modified _rtw_join_timeout_handler() to use spin_[un]lock_irq() instead of spin_[un]lock_bh().

_rtw_join_timeout_handler() calls rtw_do_join() which takes pmlmepriv->scanned_queue.lock using spin_[un]lock_bh(). This spin_unlock_bh() call re-enables softirqs which triggers an oops in kernel/softirq.c: __local_bh_enable_ip() when it calls lockdep_assert_irqs_enabled():

[ 244.506087] WARNING: CPU: 2 PID: 0 at kernel/softirq.c:376 __local_bh_enable_ip+0xa6/0x100 ... [ 244.509022] Call Trace: [ 244.509048] <IRQ> [ 244.509100] _rtw_join_timeout_handler+0x134/0x170 [r8723bs] [ 244.509468] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs] [ 244.509772] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs] [ 244.510076] call_timer_fn+0x95/0x2a0 [ 244.510200] __run_timers.part.0+0x1da/0x2d0

This oops is causd by the switch to spin_[un]lock_irq() which disables the IRQs for the entire duration of _rtw_join_timeout_handler().

Disabling the IRQs is not necessary since all code taking this lock runs from either user contexts or from softirqs, switch back to spin_[un]lock_bh() to fix this.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-667 Improper Locking

Affected Products

Product	Versions
LinuxLinux	ae60744d5fad840b9d056d35b4b652d95e755846 to before 209850f17717a3b5cc558578bef5631ac7045539Affected 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc to before 2a50e44a66d268ee5db3d177f1fdc1503dbce6e7Affected 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc to before dc327e87c6d9bfd9ee08e76396b3c0ba848ec554Affected 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc to before 4ab1bace1dd3875371b481ef4301c4671bddea22Affected 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc to before 215792eda008f6a1e7ed9d77fa20d582d22bb114Affected 1f6c99b94ca3caad346876b3e22e3ca3d25bc8eeAffected eca9748d9267a38d532464e3305a38629e9c35a9Affected 5.15.47 to before 5.15.111Affected 5.17.15 to before 5.18Affected 5.18.4 to before 5.19Affected
LinuxLinux	5.19Affected before 5.19Not affected 5.15.111 through 5.15.Not affected 6.1.28 through 6.1.Not affected 6.2.15 through 6.2.Not affected 6.3.2 through 6.3.Not affected 6.4 and laterNot affected

Product

Versions

LinuxLinux

ae60744d5fad840b9d056d35b4b652d95e755846 to before 209850f17717a3b5cc558578bef5631ac7045539Affected
041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc to before 2a50e44a66d268ee5db3d177f1fdc1503dbce6e7Affected
041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc to before dc327e87c6d9bfd9ee08e76396b3c0ba848ec554Affected
041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc to before 4ab1bace1dd3875371b481ef4301c4671bddea22Affected
041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc to before 215792eda008f6a1e7ed9d77fa20d582d22bb114Affected
1f6c99b94ca3caad346876b3e22e3ca3d25bc8eeAffected
eca9748d9267a38d532464e3305a38629e9c35a9Affected
5.15.47 to before 5.15.111Affected
5.17.15 to before 5.18Affected
5.18.4 to before 5.19Affected

LinuxLinux

5.19Affected
before 5.19Not affected
5.15.111 through 5.15.*Not affected
6.1.28 through 6.1.*Not affected
6.2.15 through 6.2.*Not affected
6.3.2 through 6.3.*Not affected
6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.