---
id: CVE-2023-53111
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  loop: Fix use-after-free issues

  do_req_filebacked() calls blk_mq_complete_request() synchronously or
  asynchronously when using asynchronous I/O unless memory allocatio…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  loop: Fix use-after-free issues

  do_req_filebacked() calls blk_mq_complete_request() synchronously or
  asynchronously when using asynchronous I/O unless memory allocatio…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.4, < 5.15.104'
  - 'linux_kernel >= 5.16, < 6.1.21'
  - 'linux_kernel >= 6.2, < 6.2.8'
  - linux_kernel = 6.3
patched:
  - linux_kernel 6.2.8
published: '2025-05-02'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:38.137'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-53111'
references:
  - url: 'https://git.kernel.org/stable/c/407badf73ec9fb0d5744bf2ca1745c1818aa222f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6917395c4667cfb607ed8bf1826205a59414657c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9b0cb770f5d7b1ff40bea7ca385438ee94570eec'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e3fda704903f6d1fc351412f1bc6620333959ada'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/81bf9d78fa246a166619196ff5005430ed2bc7c2'
tags:
  - nvd
  - cve.org
epss: 0.00207
epssPercentile: 0.10665
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:33:59.619907Z'
ingestedAt: '2026-10-15T22:48:25.391Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

loop: Fix use-after-free issues

do_req_filebacked() calls blk_mq_complete_request() synchronously or
asynchronously when using asynchronous I/O unless memory allocation fails.
Hence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor
'rq' after do_req_filebacked() finished unless we are sure that the request
has not yet been completed. This patch fixes the following kernel crash:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000054
Call trace:
 css_put.42938+0x1c/0x1ac
 loop_process_work+0xc8c/0xfd4
 loop_rootcg_workfn+0x24/0x34
 process_one_work+0x244/0x558
 worker_thread+0x400/0x8fc
 kthread+0x16c/0x1e0
 ret_from_fork+0x10/0x20

## Affected

- `linux_kernel >= 4.4, < 5.15.104`
- `linux_kernel >= 5.16, < 6.1.21`
- `linux_kernel >= 6.2, < 6.2.8`
- `linux_kernel = 6.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.2.8`