In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix null-ptr-deref in raid10_sync_request

init_resync() inits mempool and sets conf->have_replacemnt at the beginning
of sync, close_sync() frees the mempool when sync is completed.

After [1] recovery might be skipped and init_resync() is called but
close_sync() is not. null-ptr-deref occurs with r10bio->dev[i].repl_bio.

The following is one way to reproduce the issue.

1) create a array, wait for resync to complete, mddev->recovery_cp is set
to MaxSector.
2) recovery is woken and it is skipped. conf->have_replacement is set to
0 in init_resync(). close_sync() not called.
3) some io errors and rdev A is set to WantReplacement.
4) a new device is added and set to A's replacement.
5) recovery is woken, A have replacement, but conf->have_replacemnt is
0. r10bio->dev[i].repl_bio will not be alloced and null-ptr-deref
occurs.

Fix it by not calling init_resync() if recovery skipped.

[1] commit 7e83ccbecd60 ("md/raid10: Allow skipping recovery when clean arrays are assembled")

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00036.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
7e83ccbecd608b971f340e951c9e84cd0343002f affected < 38d33593260536840b49fd1dcac9aedfd14a9d42
7e83ccbecd608b971f340e951c9e84cd0343002f affected < 14964127be77884003976a392c9faa9ebaabbbe1
7e83ccbecd608b971f340e951c9e84cd0343002f affected < bdbf104b1c91fbf38f82c522ebf75429f094292a
7e83ccbecd608b971f340e951c9e84cd0343002f affected < 68695084077e3de9d3e94e09238ace2b6f246446
7e83ccbecd608b971f340e951c9e84cd0343002f affected < b50fd1c3d9d0175aa29ff2706ef36cc178bc356a
7e83ccbecd608b971f340e951c9e84cd0343002f affected < 99b503e4edc5938885d839cf0e7571963f75d800
7e83ccbecd608b971f340e951c9e84cd0343002f affected < 9e9efc77efd1956cc244af975240f2513d78a371
7e83ccbecd608b971f340e951c9e84cd0343002f affected < a405c6f0229526160aa3f177f65e20c86fce84c5
Linux Linux affected
Version Status Constraints
3.10 affected —
0 unaffected < 3.10
4.19.283 unaffected ≤ 4.19.*
5.4.243 unaffected ≤ 5.4.*
5.10.180 unaffected ≤ 5.10.*
5.15.111 unaffected ≤ 5.15.*
6.1.28 unaffected ≤ 6.1.*
6.2.15 unaffected ≤ 6.2.*
6.3.2 unaffected ≤ 6.3.*
6.4 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/14964127be77884003976a392c9faa9ebaabbbe1 cve-icon cve-icon
https://git.kernel.org/stable/c/38d33593260536840b49fd1dcac9aedfd14a9d42 cve-icon cve-icon
https://git.kernel.org/stable/c/68695084077e3de9d3e94e09238ace2b6f246446 cve-icon cve-icon
https://git.kernel.org/stable/c/99b503e4edc5938885d839cf0e7571963f75d800 cve-icon cve-icon
https://git.kernel.org/stable/c/9e9efc77efd1956cc244af975240f2513d78a371 cve-icon cve-icon
https://git.kernel.org/stable/c/a405c6f0229526160aa3f177f65e20c86fce84c5 cve-icon cve-icon
https://git.kernel.org/stable/c/b50fd1c3d9d0175aa29ff2706ef36cc178bc356a cve-icon cve-icon
https://git.kernel.org/stable/c/bdbf104b1c91fbf38f82c522ebf75429f094292a cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025120954-CVE-2023-53832-6d46@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-53832 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-53832 cve-icon
History

Wed, 10 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Tue, 09 Dec 2025 02:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null-ptr-deref in raid10_sync_request init_resync() inits mempool and sets conf->have_replacemnt at the beginning of sync, close_sync() frees the mempool when sync is completed. After [1] recovery might be skipped and init_resync() is called but close_sync() is not. null-ptr-deref occurs with r10bio->dev[i].repl_bio. The following is one way to reproduce the issue. 1) create a array, wait for resync to complete, mddev->recovery_cp is set to MaxSector. 2) recovery is woken and it is skipped. conf->have_replacement is set to 0 in init_resync(). close_sync() not called. 3) some io errors and rdev A is set to WantReplacement. 4) a new device is added and set to A's replacement. 5) recovery is woken, A have replacement, but conf->have_replacemnt is 0. r10bio->dev[i].repl_bio will not be alloced and null-ptr-deref occurs. Fix it by not calling init_resync() if recovery skipped. [1] commit 7e83ccbecd60 ("md/raid10: Allow skipping recovery when clean arrays are assembled")
Title md/raid10: fix null-ptr-deref in raid10_sync_request
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-09T01:29:47.513Z

Reserved: 2025-12-09T01:27:17.825Z

Link: CVE-2023-53832

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-09T16:17:22.133

Modified: 2025-12-09T18:37:13.640

Link: CVE-2023-53832

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-12-09T00:00:00Z

Links: CVE-2023-53832 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.