GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53531 (GCVE-0-2023-53531)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:46 – Updated: 2026-08-05 09:14
VLAI
Title
null_blk: fix poll request timeout handling
Summary
In the Linux kernel, the following vulnerability has been resolved: null_blk: fix poll request timeout handling When doing io_uring benchmark on /dev/nullb0, it's easy to crash the kernel if poll requests timeout triggered, as reported by David. [1] BUG: kernel NULL pointer dereference, address: 0000000000000008 Workqueue: kblockd blk_mq_timeout_work RIP: 0010:null_timeout_rq+0x4e/0x91 Call Trace: ? null_timeout_rq+0x4e/0x91 blk_mq_handle_expired+0x31/0x4b bt_iter+0x68/0x84 ? bt_tags_iter+0x81/0x81 __sbitmap_for_each_set.constprop.0+0xb0/0xf2 ? __blk_mq_complete_request_remote+0xf/0xf bt_for_each+0x46/0x64 ? __blk_mq_complete_request_remote+0xf/0xf ? percpu_ref_get_many+0xc/0x2a blk_mq_queue_tag_busy_iter+0x14d/0x18e blk_mq_timeout_work+0x95/0x127 process_one_work+0x185/0x263 worker_thread+0x1b5/0x227 This is indeed a race problem between null_timeout_rq() and null_poll(). null_poll() null_timeout_rq() spin_lock(&nq->poll_lock) list_splice_init(&nq->poll_list, &list) spin_unlock(&nq->poll_lock) while (!list_empty(&list)) req = list_first_entry() list_del_init() ... blk_mq_add_to_batch() // req->rq_next = NULL spin_lock(&nq->poll_lock) // rq->queuelist->next == NULL list_del_init(&rq->queuelist) spin_unlock(&nq->poll_lock) Fix these problems by setting requests state to MQ_RQ_COMPLETE under nq->poll_lock protection, in which null_timeout_rq() can safely detect this race and early return. Note this patch just fix the kernel panic when request timeout happen. [1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0a593fbbc245a85940ed34caa3aa1e4cb060c54b , < a0b4a0666beacfe8add9c71d8922475541dbae73 (git)
Affected: 0a593fbbc245a85940ed34caa3aa1e4cb060c54b , < a7cb2e709f2927cc3c76781df3e45de2381b3b9d (git)
Affected: 0a593fbbc245a85940ed34caa3aa1e4cb060c54b , < 5a26e45edb4690d58406178b5a9ea4c6dcf2c105 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.54 , ≤ 6.1.* (semver)
Unaffected: 6.5.4 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/null_blk/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a0b4a0666beacfe8add9c71d8922475541dbae73",
              "status": "affected",
              "version": "0a593fbbc245a85940ed34caa3aa1e4cb060c54b",
              "versionType": "git"
            },
            {
              "lessThan": "a7cb2e709f2927cc3c76781df3e45de2381b3b9d",
              "status": "affected",
              "version": "0a593fbbc245a85940ed34caa3aa1e4cb060c54b",
              "versionType": "git"
            },
            {
              "lessThan": "5a26e45edb4690d58406178b5a9ea4c6dcf2c105",
              "status": "affected",
              "version": "0a593fbbc245a85940ed34caa3aa1e4cb060c54b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/null_blk/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.54",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.4",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: fix poll request timeout handling\n\nWhen doing io_uring benchmark on /dev/nullb0, it\u0027s easy to crash the\nkernel if poll requests timeout triggered, as reported by David. [1]\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nWorkqueue: kblockd blk_mq_timeout_work\nRIP: 0010:null_timeout_rq+0x4e/0x91\nCall Trace:\n ? null_timeout_rq+0x4e/0x91\n blk_mq_handle_expired+0x31/0x4b\n bt_iter+0x68/0x84\n ? bt_tags_iter+0x81/0x81\n __sbitmap_for_each_set.constprop.0+0xb0/0xf2\n ? __blk_mq_complete_request_remote+0xf/0xf\n bt_for_each+0x46/0x64\n ? __blk_mq_complete_request_remote+0xf/0xf\n ? percpu_ref_get_many+0xc/0x2a\n blk_mq_queue_tag_busy_iter+0x14d/0x18e\n blk_mq_timeout_work+0x95/0x127\n process_one_work+0x185/0x263\n worker_thread+0x1b5/0x227\n\nThis is indeed a race problem between null_timeout_rq() and null_poll().\n\nnull_poll()\t\t\t\tnull_timeout_rq()\n  spin_lock(\u0026nq-\u003epoll_lock)\n  list_splice_init(\u0026nq-\u003epoll_list, \u0026list)\n  spin_unlock(\u0026nq-\u003epoll_lock)\n\n  while (!list_empty(\u0026list))\n    req = list_first_entry()\n    list_del_init()\n    ...\n    blk_mq_add_to_batch()\n    // req-\u003erq_next = NULL\n\t\t\t\t\tspin_lock(\u0026nq-\u003epoll_lock)\n\n\t\t\t\t\t// rq-\u003equeuelist-\u003enext == NULL\n\t\t\t\t\tlist_del_init(\u0026rq-\u003equeuelist)\n\n\t\t\t\t\tspin_unlock(\u0026nq-\u003epoll_lock)\n\nFix these problems by setting requests state to MQ_RQ_COMPLETE under\nnq-\u003epoll_lock protection, in which null_timeout_rq() can safely detect\nthis race and early return.\n\nNote this patch just fix the kernel panic when request timeout happen.\n\n[1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires opening the local block device /dev/nullb0 and issuing polled direct I/O (io_uring IOPOLL or preadv2 RWF_HIPRI); there is no remote or adjacent-network path into null_blk.\nAC:L - The attacker controls both sides of the race \u2014 it submits the polled requests, controls when it calls into null_poll(), and the 5-second timeout is fixed unconditionally by null_add_dev() (tag_set-\u003etimeout = 5 * HZ), so the collision with blk_mq_timeout_work can be arranged deterministically and retried; the fix author notes it is \"easy to crash the kernel.\"\nPR:L - The vulnerable path contains no capability or namespace check \u2014 any local user able to open the null_blk device node (group disk, benchmarking/CI accounts, or a container handed the device) can reach null_queue_rq/null_poll with ordinary O_DIRECT reads.\nUI:N - The attacker performs the submissions and polling itself; no victim action is required to trigger the race.\nS:U - The corruption is confined to kernel block-layer structures within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Beyond the NULL case, list_del_init() writes \u0026rq-\u003equeuelist into the io_comp_batch chain, so blk_mq_end_request_batch() dereferences a bogus struct request and bio pointers, and the double blk_mq_complete_request() frees the tag twice yielding request reuse \u2014 a UAF-class read primitive over kernel heap contents.\nI:H - The race produces doubly-linked-list corruption plus double request completion (tag double-free and reallocation to a concurrent I/O), giving attacker-influenced kernel heap writes exploitable for control-flow hijacking.\nA:H - The documented result is a kernel NULL pointer dereference oops at address 0x8 inside blk_mq_timeout_work on the kblockd workqueue, killing the worker and panicking or wedging the block layer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:38.269Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a0b4a0666beacfe8add9c71d8922475541dbae73"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7cb2e709f2927cc3c76781df3e45de2381b3b9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a26e45edb4690d58406178b5a9ea4c6dcf2c105"
        }
      ],
      "title": "null_blk: fix poll request timeout handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53531",
    "datePublished": "2025-10-01T11:46:15.949Z",
    "dateReserved": "2025-10-01T11:39:39.408Z",
    "dateUpdated": "2026-08-05T09:14:38.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53531",
      "date": "2026-09-16",
      "epss": "0.00151",
      "percentile": "0.04634"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53531\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-01T12:15:57.843\",\"lastModified\":\"2026-08-04T10:19:10.767\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnull_blk: fix poll request timeout handling\\n\\nWhen doing io_uring benchmark on /dev/nullb0, it\u0027s easy to crash the\\nkernel if poll requests timeout triggered, as reported by David. [1]\\n\\nBUG: kernel NULL pointer dereference, address: 0000000000000008\\nWorkqueue: kblockd blk_mq_timeout_work\\nRIP: 0010:null_timeout_rq+0x4e/0x91\\nCall Trace:\\n ? null_timeout_rq+0x4e/0x91\\n blk_mq_handle_expired+0x31/0x4b\\n bt_iter+0x68/0x84\\n ? bt_tags_iter+0x81/0x81\\n __sbitmap_for_each_set.constprop.0+0xb0/0xf2\\n ? __blk_mq_complete_request_remote+0xf/0xf\\n bt_for_each+0x46/0x64\\n ? __blk_mq_complete_request_remote+0xf/0xf\\n ? percpu_ref_get_many+0xc/0x2a\\n blk_mq_queue_tag_busy_iter+0x14d/0x18e\\n blk_mq_timeout_work+0x95/0x127\\n process_one_work+0x185/0x263\\n worker_thread+0x1b5/0x227\\n\\nThis is indeed a race problem between null_timeout_rq() and null_poll().\\n\\nnull_poll()\\t\\t\\t\\tnull_timeout_rq()\\n  spin_lock(\u0026nq-\u003epoll_lock)\\n  list_splice_init(\u0026nq-\u003epoll_list, \u0026list)\\n  spin_unlock(\u0026nq-\u003epoll_lock)\\n\\n  while (!list_empty(\u0026list))\\n    req = list_first_entry()\\n    list_del_init()\\n    ...\\n    blk_mq_add_to_batch()\\n    // req-\u003erq_next = NULL\\n\\t\\t\\t\\t\\tspin_lock(\u0026nq-\u003epoll_lock)\\n\\n\\t\\t\\t\\t\\t// rq-\u003equeuelist-\u003enext == NULL\\n\\t\\t\\t\\t\\tlist_del_init(\u0026rq-\u003equeuelist)\\n\\n\\t\\t\\t\\t\\tspin_unlock(\u0026nq-\u003epoll_lock)\\n\\nFix these problems by setting requests state to MQ_RQ_COMPLETE under\\nnq-\u003epoll_lock protection, in which null_timeout_rq() can safely detect\\nthis race and early return.\\n\\nNote this patch just fix the kernel panic when request timeout happen.\\n\\n[1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/block/null_blk/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0a593fbbc245a85940ed34caa3aa1e4cb060c54b\",\"lessThan\":\"a0b4a0666beacfe8add9c71d8922475541dbae73\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a593fbbc245a85940ed34caa3aa1e4cb060c54b\",\"lessThan\":\"a7cb2e709f2927cc3c76781df3e45de2381b3b9d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a593fbbc245a85940ed34caa3aa1e4cb060c54b\",\"lessThan\":\"5a26e45edb4690d58406178b5a9ea4c6dcf2c105\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/block/null_blk/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.54\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5.4\",\"lessThanOrEqual\":\"6.5.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.54\",\"matchCriteriaId\":\"7353B9B4-AFFC-45DE-840E-1A7D2B00E7AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.5.4\",\"matchCriteriaId\":\"CA8C8B88-AF36-445D-A228-AD78F3615373\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5a26e45edb4690d58406178b5a9ea4c6dcf2c105\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a0b4a0666beacfe8add9c71d8922475541dbae73\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7cb2e709f2927cc3c76781df3e45de2381b3b9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:18:13+00:00",
      "cve": "CVE-2023-53531",
      "id": "CVE-2023-53531",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "174",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: null_blk: fix poll request timeout handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53531.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:46:48Z",
      "cve": "CVE-2023-53531",
      "id": "CVE-2023-53531",
      "initial_release_date": "2025-10-01T23:29:28Z",
      "product_status:known_affected": "369",
      "product_status:known_not_affected": "326",
      "product_status:recommended": "402",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53531",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53531.json",
      "version": "52"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.