CVE-2023-53791

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.5.0-rc2-00121-g01e55c376936-dirty

Description The Linux kernel contains an issue related to a holder mismatch within the export rdev() function in the md (multiple device) subsystem. A warning occurs when claim rdev is used with blkdev get by dev() while rdev is used with blkdev put(). This can happen if mddev->external changes from 0 to 1. The issue is reproducible through a specific test case involving adding and removing devices via sysfs. The test case involves writing to /sys/block/md0/md/new dev and /sys/block/md0/md/dev-${devname}/state. The call trace indicates the issue occurs within the blkdev put() function.

Recommendations Update to Linux kernel version 6.5.0-rc2-00121-g01e55c376936-dirty or later.