CVE-2023-53656

What it actually does

The hisi_pcie_pmu driver may migrate a perf context to a CPU still present in cpu_online_mask during cpuhp::teardown, causing perf_pmu_migrate_context to deadlock on a mutex while the CPU is going offline.

Why it matters to the business

Systems can hang or crash during CPU offline events, disrupting performance monitoring and container or virtualized workloads that rely on CPU hotplug; remediation deadlines and related kernel privilege-escalation activity increase operational urgency for affected Linux deployments.

How an attack unfolds

An attacker with local access triggers or waits for a CPU teardown event while perf contexts are active on the hisi driver; the incorrect CPU selection leads to the observed schedule/mutex deadlock call trace. Related container-optimized OS privilege-escalation techniques observed in similar kernel issues can be chained for further impact.

How to fix it

Apply the upstream fix that replaces the migration logic with cpumask_any_but() to select an active CPU; for snipe/snipe-it deployments upgrade to version 7.0.10.

How to confirm the fix worked

Confirm the cpumask_any_but() change is present in the hisi_pcie_pmu offline_cpu callback and that CPU hotplug no longer produces the mutex deadlock trace; test by repeatedly bringing CPUs offline while perf events are scheduled.

Typical attack path

1. Obtain local access on a system using the hisi_pcie_pmu driver
2. Trigger or observe CPU offline/hotplug teardown
3. Perf context migration selects the teardown CPU
4. Deadlock occurs in perf_pmu_migrate_context and cpuhp thread

How to detect it

Search kernel logs for the mutex_lock and perf_pmu_migrate_context call trace involving hisi_pcie_pmu_offline_cpu; correlate with cpuhp_thread_fun entries and unexpected CPU offline events.

• hisi_pcie_pmu_offline_cpu
• perf_pmu_migrate_context
• __mutex_lock.constprop.0
• cpuhp_invoke_callback

What your security team should do

• Prioritize patching systems that perform frequent CPU hotplug or run container workloads
• Upgrade snipe/snipe-it to 7.0.10 where the package is present
• Monitor for related Linux kernel privilege-escalation activity listed under similar CVEs
• Review EPSS trend and re-assess exposure within 30 days