CVE-2023-53810

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the block multi-queue (blk-mq) subsystem of the Linux kernel. The block layer fails to call blk crypto put keyslot() until a request is freed, which occurs after upper layers are notified of I/O completion via bio endio(). This allows blk crypto evict key() to incorrectly detect that a keyslot is still in use when slot refs is not zero. Consequently, the blk crypto evict key() function may trigger a WARN ON ONCE() and return without action, eventually leading to a use-after-free in blk crypto reprogram all keys(). This issue is rare and primarily occurs when per-file keys are used with fscrypt.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.