{"id":"CVE-2023-53111","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nloop: Fix use-after-free issues\n\ndo_req_filebacked() calls blk_mq_complete_request() synchronously or\nasynchronously when using asynchronous I/O unless memory allocatio…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nloop: Fix use-after-free issues\n\ndo_req_filebacked() calls blk_mq_complete_request() synchronously or\nasynchronously when using asynchronous I/O unless memory allocatio…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.4, < 5.15.104","linux_kernel >= 5.16, < 6.1.21","linux_kernel >= 6.2, < 6.2.8","linux_kernel = 6.3"],"patched":["linux_kernel 6.2.8"],"published":"2025-05-02","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:17:38.137","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-53111","references":[{"url":"https://git.kernel.org/stable/c/407badf73ec9fb0d5744bf2ca1745c1818aa222f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6917395c4667cfb607ed8bf1826205a59414657c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b0cb770f5d7b1ff40bea7ca385438ee94570eec","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3fda704903f6d1fc351412f1bc6620333959ada","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00207,"epssPercentile":0.10665,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:33:59.619907Z"},"ingestedAt":"2026-10-15T22:48:25.391Z","slug":"CVE-2023-53111","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nloop: Fix use-after-free issues\n\ndo_req_filebacked() calls blk_mq_complete_request() synchronously or\nasynchronously when using asynchronous I/O unless memory allocation fails.\nHence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor\n'rq' after do_req_filebacked() finished unless we are sure that the request\nhas not yet been completed. This patch fixes the following kernel crash:\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000054\nCall trace:\n css_put.42938+0x1c/0x1ac\n loop_process_work+0xc8c/0xfd4\n loop_rootcg_workfn+0x24/0x34\n process_one_work+0x244/0x558\n worker_thread+0x400/0x8fc\n kthread+0x16c/0x1e0\n ret_from_fork+0x10/0x20\n\n## Affected\n\n- `linux_kernel >= 4.4, < 5.15.104`\n- `linux_kernel >= 5.16, < 6.1.21`\n- `linux_kernel >= 6.2, < 6.2.8`\n- `linux_kernel = 6.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.2.8`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}