CVE-2023-53111loop: Fix use-after-free issues
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: loop: Fix use-after-free issues do_req_filebacked() calls blk_mq_complete_request() synchronously or asynchronously when using asynchronous I/O unless memory allocation fails. Hence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor 'rq' after do_req_filebacked() finished unless we are sure that the request has not yet been completed. This patch fixes the following kernel crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000054 Call trace: css_put.42938+0x1c/0x1ac loop_process_work+0xc8c/0xfd4 loop_rootcg_workfn+0x24/0x34 process_one_work+0x244/0x558 worker_thread+0x400/0x8fc kthread+0x16c/0x1e0 ret_from_fork+0x10/0x20
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from bc07c10a3603a5ab3ef01ba42b3d41f9ac63d1b6 before 407badf73ec9fb0d5744bf2ca1745c1818aa222f; from bc07c10a3603a5ab3ef01ba42b3d41f9ac63d1b6 before e3fda704903f6d1fc351412f1bc6620333959ada; from bc07c10a3603a5ab3ef01ba42b3d41f9ac63d1b6 before 6917395c4667cfb607ed8bf1826205a59414657c; from bc07c10a3603a5ab3ef01ba42b3d41f9ac63d1b6 before 9b0cb770f5d7b1ff40bea7ca385438ee94570eec | CNA record |
linux linux_kernel linux:linux_kernel | from 4.4 before 5.15.104; from 5.16 before 6.1.21; from 6.2 before 6.2.8; 6.3; 6.3 | NVD |
References
- https://git.kernel.org/stable/c/407badf73ec9fb0d5744bf2ca1745c1818aa222fpatch
- https://git.kernel.org/stable/c/e3fda704903f6d1fc351412f1bc6620333959adapatch
- https://git.kernel.org/stable/c/6917395c4667cfb607ed8bf1826205a59414657cpatch
- https://git.kernel.org/stable/c/9b0cb770f5d7b1ff40bea7ca385438ee94570eecpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.