{"id":"CVE-2023-53116","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: avoid potential UAF in nvmet_req_complete()\n\nAn nvme target ->queue_response() operation implementation may free the\nrequest passed as argument","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: avoid potential UAF in nvmet_req_complete()\n\nAn nvme target ->queue_response() operation implementation may free the\nrequest passed as argument. Such implementat…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416","CWE-825"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.8, < 4.14.311","linux_kernel >= 4.15, < 4.19.279","linux_kernel >= 4.20, < 5.4.238","linux_kernel >= 5.5, < 5.10.176","linux_kernel >= 5.11, < 5.15.104","linux_kernel >= 5.16, < 6.1.21","linux_kernel >= 6.2, < 6.2.8","linux_kernel = 6.3"],"patched":["linux_kernel 6.2.8"],"published":"2025-05-02","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:17:38.293","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-53116","references":[{"url":"https://git.kernel.org/stable/c/04c394208831d5e0d5cfee46722eb0f033cd4083","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6173a77b7e9d3e202bdb9897b23f2a8afe7bf286","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ed9813871038b25a934b21ab76b5b7dbf44fc3a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6317235da8aa7cb97529ebc8121cc2a4c4c437a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bcd535f07c58342302a2cd2bdd8894fe0872c8a9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5d99b29012bbf0e86929403209723b2806500c1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1d5888a5efe345b63c430b256e95acb0a475642","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fafcb4b26393870c45462f9af6a48e581dbbcf7e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53116.json"},{"url":"https://access.redhat.com/security/cve/CVE-2023-53116"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2363763"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-53116"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53116"},{"url":"https://lore.kernel.org/linux-cve-announce/2025050229-CVE-2023-53116-469c@gregkh/T"}],"tags":["nvd","csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.00538,"epssPercentile":0.45099,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-15T21:34:05.995593Z"},"scores":{"nvd":9.8,"vendor":5.5,"cna":9.8},"ingestedAt":"2026-10-15T22:48:25.391Z","slug":"CVE-2023-53116","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: avoid potential UAF in nvmet_req_complete()\n\nAn nvme target ->queue_response() operation implementation may free the\nrequest passed as argument. Such implementation potentially could result\nin a use after free of the request pointer when percpu_ref_put() is\ncalled in nvmet_req_complete().\n\nAvoid such problem by using a local variable to save the sq pointer\nbefore calling __nvmet_req_complete(), thus avoiding dereferencing the\nreq pointer after that function call.\n\n## Affected\n\n- `linux_kernel >= 4.8, < 4.14.311`\n- `linux_kernel >= 4.15, < 4.19.279`\n- `linux_kernel >= 4.20, < 5.4.238`\n- `linux_kernel >= 5.5, < 5.10.176`\n- `linux_kernel >= 5.11, < 5.15.104`\n- `linux_kernel >= 5.16, < 6.1.21`\n- `linux_kernel >= 6.2, < 6.2.8`\n- `linux_kernel = 6.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.2.8`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53116.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":230027,"id":"CVE-2023-53116","ts":1793124770974,"field":"cvss","old":"5.5","new":"9.8"},{"seq":230026,"id":"CVE-2023-53116","ts":1793124770974,"field":"severity","old":"medium","new":"critical"},{"seq":223753,"id":"CVE-2023-53116","ts":1792238388382,"field":"cvss","old":"9.8","new":"5.5"},{"seq":223752,"id":"CVE-2023-53116","ts":1792238388382,"field":"severity","old":"critical","new":"medium"}]}