DEBIAN-CVE-2023-53531

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2023-53531
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53531.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2023-53531
Upstream
Published
2025-10-01T12:15:57Z
Modified
2025-10-02T09:25:22.730228Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved: nullblk: fix poll request timeout handling When doing iouring benchmark on /dev/nullb0, it's easy to crash the kernel if poll requests timeout triggered, as reported by David. [1] BUG: kernel NULL pointer dereference, address: 0000000000000008 Workqueue: kblockd blkmqtimeoutwork RIP: 0010:nulltimeoutrq+0x4e/0x91 Call Trace: ? nulltimeoutrq+0x4e/0x91 blkmqhandleexpired+0x31/0x4b btiter+0x68/0x84 ? bttagsiter+0x81/0x81 _sbitmapforeachset.constprop.0+0xb0/0xf2 ? _blkmqcompleterequestremote+0xf/0xf btforeach+0x46/0x64 ? _blkmqcompleterequestremote+0xf/0xf ? percpurefgetmany+0xc/0x2a blkmqqueuetagbusyiter+0x14d/0x18e blkmqtimeoutwork+0x95/0x127 processonework+0x185/0x263 workerthread+0x1b5/0x227 This is indeed a race problem between nulltimeoutrq() and nullpoll(). nullpoll() nulltimeoutrq() spinlock(&nq->polllock) listspliceinit(&nq->polllist, &list) spinunlock(&nq->polllock) while (!listempty(&list)) req = listfirstentry() listdelinit() ... blkmqaddtobatch() // req->rqnext = NULL spinlock(&nq->polllock) // rq->queuelist->next == NULL listdelinit(&rq->queuelist) spinunlock(&nq->polllock) Fix these problems by setting requests state to MQRQCOMPLETE under nq->polllock protection, in which nulltimeout_rq() can safely detect this race and early return. Note this patch just fix the kernel panic when request timeout happen. [1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/

References

Affected packages

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.55-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.5.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.5.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}