{"id":"CVE-2023-53624","title":"net/sched: sch_fq: fix integer overflow of \"credit\"","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_fq: fix integer overflow of \"credit\"\n\nif sch_fq is configured with \"initial quantum\" having values greater than\nINT_MAX, the first assignment of \"credit\"…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 4b8a05e3801661a0438fcd0cdef181030d966a5a","Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < d0b43125ec892aeb1b03e5df5aab595097da225a","Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 4fbefeab88c6e79753a25099d455d3d59d2946b4","Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 85f24cb2f10b2b0f2882e5786a09b4790bb3a0ad","Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 2322462d6f9ad4874f4e3c63df3b5cc00cb1acbd","Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 7041101ff6c3073fd8f2e99920f535b111c929cb","Linux 3.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:26:02.351789Z"},"published":"2025-10-07","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:31:18.437Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-53624","references":[{"url":"https://git.kernel.org/stable/c/4b8a05e3801661a0438fcd0cdef181030d966a5a"},{"url":"https://git.kernel.org/stable/c/d0b43125ec892aeb1b03e5df5aab595097da225a"},{"url":"https://git.kernel.org/stable/c/4fbefeab88c6e79753a25099d455d3d59d2946b4"},{"url":"https://git.kernel.org/stable/c/85f24cb2f10b2b0f2882e5786a09b4790bb3a0ad"},{"url":"https://git.kernel.org/stable/c/2322462d6f9ad4874f4e3c63df3b5cc00cb1acbd"},{"url":"https://git.kernel.org/stable/c/7041101ff6c3073fd8f2e99920f535b111c929cb"}],"tags":["cve.org"],"epss":0.00208,"epssPercentile":0.11034,"ingestedAt":"2026-11-05T22:38:31.820Z","slug":"CVE-2023-53624","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_fq: fix integer overflow of \"credit\"\n\nif sch_fq is configured with \"initial quantum\" having values greater than\nINT_MAX, the first assignment of \"credit\" does signed integer overflow to\na very negative value.\nIn this situation, the syzkaller script provided by Cristoph triggers the\nCPU soft-lockup warning even with few sockets. It's not an infinite loop,\nbut \"credit\" wasn't probably meant to be minus 2Gb for each new flow.\nCapping \"initial quantum\" to INT_MAX proved to fix the issue.\n\nv2: validation of \"initial quantum\" is done in fq_policy, instead of open\n    coding in fq_change() _ suggested by Jakub Kicinski\n\n## Affected\n\n- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 4b8a05e3801661a0438fcd0cdef181030d966a5a`\n- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < d0b43125ec892aeb1b03e5df5aab595097da225a`\n- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 4fbefeab88c6e79753a25099d455d3d59d2946b4`\n- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 85f24cb2f10b2b0f2882e5786a09b4790bb3a0ad`\n- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 2322462d6f9ad4874f4e3c63df3b5cc00cb1acbd`\n- `Linux >= afe4fd062416b158a8a8538b23adc1930a9b88dc < 7041101ff6c3073fd8f2e99920f535b111c929cb`\n- `Linux 3.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}