CVE-2023-53712

The vulnerability is a bug in the Linux kernel's crash handling on ARM systems. When a panic is triggered by a hrtimer interrupt (e.g., from a watchdog timer), the code in crash_smp_send_stop() calls smp_call_function() synchronously with interrupts disabled. This triggers a warning because smp_call_function() should not be used from softirq context, as highlighted by commit 19dbdcb8039c [1].

To exploit this, an attacker would need to trigger a panic via a timer interrupt on a multi-core ARM system. This could be achieved through local access to a watchdog or similar mechanism that causes a kernel panic. The attack surface is limited to local users who can trigger such events.

The impact is a kernel warning and potential system instability, but no direct security compromise (e.g., privilege escalation or data breach). The warning may cause log noise and disrupt debugging, but the system may continue to operate.

The fix, committed to the Linux kernel stable branches [1][2], makes the SMP call asynchronous by using smp_call_function_single_async() instead of the synchronous variant, avoiding the warning condition. Users should update to a kernel version containing this patch.