CVE-2023-53116

nvmet: avoid potential UAF in nvmet_req_complete()

State: Published
Severity: 9.8 Critical
Published: May 2, 2025
Updated: Oct 15, 2026
Reserved: May 2, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: avoid potential UAF in nvmet_req_complete()

An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpu_ref_put() is called in nvmet_req_complete().

Avoid such problem by using a local variable to save the sq pointer before calling __nvmet_req_complete(), thus avoiding dereferencing the req pointer after that function call.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a07b4970f464f13640e28e16dad6cfa33647cc99 to before e5d99b29012bbf0e86929403209723b2806500c1Affected a07b4970f464f13640e28e16dad6cfa33647cc99 to before fafcb4b26393870c45462f9af6a48e581dbbcf7eAffected a07b4970f464f13640e28e16dad6cfa33647cc99 to before 04c394208831d5e0d5cfee46722eb0f033cd4083Affected a07b4970f464f13640e28e16dad6cfa33647cc99 to before a6317235da8aa7cb97529ebc8121cc2a4c4c437aAffected a07b4970f464f13640e28e16dad6cfa33647cc99 to before f1d5888a5efe345b63c430b256e95acb0a475642Affected a07b4970f464f13640e28e16dad6cfa33647cc99 to before bcd535f07c58342302a2cd2bdd8894fe0872c8a9Affected a07b4970f464f13640e28e16dad6cfa33647cc99 to before 8ed9813871038b25a934b21ab76b5b7dbf44fc3aAffected a07b4970f464f13640e28e16dad6cfa33647cc99 to before 6173a77b7e9d3e202bdb9897b23f2a8afe7bf286Affected
LinuxLinux	4.8Affected before 4.8Not affected 4.14.311 through 4.14.Not affected 4.19.279 through 4.19.Not affected 5.4.238 through 5.4.Not affected 5.10.176 through 5.10.Not affected 5.15.104 through 5.15.Not affected 6.1.21 through 6.1.Not affected 6.2.8 through 6.2.*Not affected 6.3 and laterNot affected

Product

Versions

LinuxLinux

a07b4970f464f13640e28e16dad6cfa33647cc99 to before e5d99b29012bbf0e86929403209723b2806500c1Affected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before fafcb4b26393870c45462f9af6a48e581dbbcf7eAffected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before 04c394208831d5e0d5cfee46722eb0f033cd4083Affected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before a6317235da8aa7cb97529ebc8121cc2a4c4c437aAffected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before f1d5888a5efe345b63c430b256e95acb0a475642Affected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before bcd535f07c58342302a2cd2bdd8894fe0872c8a9Affected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before 8ed9813871038b25a934b21ab76b5b7dbf44fc3aAffected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before 6173a77b7e9d3e202bdb9897b23f2a8afe7bf286Affected

LinuxLinux

4.8Affected
before 4.8Not affected
4.14.311 through 4.14.*Not affected
4.19.279 through 4.19.*Not affected
5.4.238 through 5.4.*Not affected
5.10.176 through 5.10.*Not affected
5.15.104 through 5.15.*Not affected
6.1.21 through 6.1.*Not affected
6.2.8 through 6.2.*Not affected
6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.