CVE-2023-53832

md/raid10: fix null-ptr-deref in raid10_sync_request

State: Published
Severity: Not scored
Published: Dec 9, 2025
Updated: May 11, 2026
Reserved: Dec 9, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix null-ptr-deref in raid10_sync_request

init_resync() inits mempool and sets conf->have_replacemnt at the beginning of sync, close_sync() frees the mempool when sync is completed.

After [1] recovery might be skipped and init_resync() is called but close_sync() is not. null-ptr-deref occurs with r10bio->dev[i].repl_bio.

The following is one way to reproduce the issue.

1) create a array, wait for resync to complete, mddev->recovery_cp is set to MaxSector. 2) recovery is woken and it is skipped. conf->have_replacement is set to 0 in init_resync(). close_sync() not called. 3) some io errors and rdev A is set to WantReplacement. 4) a new device is added and set to A's replacement. 5) recovery is woken, A have replacement, but conf->have_replacemnt is 0. r10bio->dev[i].repl_bio will not be alloced and null-ptr-deref occurs.

Fix it by not calling init_resync() if recovery skipped.

[1] commit 7e83ccbecd60 ("md/raid10: Allow skipping recovery when clean arrays are assembled")

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7e83ccbecd608b971f340e951c9e84cd0343002f to before 38d33593260536840b49fd1dcac9aedfd14a9d42Affected 7e83ccbecd608b971f340e951c9e84cd0343002f to before 14964127be77884003976a392c9faa9ebaabbbe1Affected 7e83ccbecd608b971f340e951c9e84cd0343002f to before bdbf104b1c91fbf38f82c522ebf75429f094292aAffected 7e83ccbecd608b971f340e951c9e84cd0343002f to before 68695084077e3de9d3e94e09238ace2b6f246446Affected 7e83ccbecd608b971f340e951c9e84cd0343002f to before b50fd1c3d9d0175aa29ff2706ef36cc178bc356aAffected 7e83ccbecd608b971f340e951c9e84cd0343002f to before 99b503e4edc5938885d839cf0e7571963f75d800Affected 7e83ccbecd608b971f340e951c9e84cd0343002f to before 9e9efc77efd1956cc244af975240f2513d78a371Affected 7e83ccbecd608b971f340e951c9e84cd0343002f to before a405c6f0229526160aa3f177f65e20c86fce84c5Affected
LinuxLinux	3.10Affected before 3.10Not affected 4.19.283 through 4.19.Not affected 5.4.243 through 5.4.Not affected 5.10.180 through 5.10.Not affected 5.15.111 through 5.15.Not affected 6.1.28 through 6.1.Not affected 6.2.15 through 6.2.Not affected 6.3.2 through 6.3.*Not affected 6.4 and laterNot affected

Product

Versions

LinuxLinux

7e83ccbecd608b971f340e951c9e84cd0343002f to before 38d33593260536840b49fd1dcac9aedfd14a9d42Affected
7e83ccbecd608b971f340e951c9e84cd0343002f to before 14964127be77884003976a392c9faa9ebaabbbe1Affected
7e83ccbecd608b971f340e951c9e84cd0343002f to before bdbf104b1c91fbf38f82c522ebf75429f094292aAffected
7e83ccbecd608b971f340e951c9e84cd0343002f to before 68695084077e3de9d3e94e09238ace2b6f246446Affected
7e83ccbecd608b971f340e951c9e84cd0343002f to before b50fd1c3d9d0175aa29ff2706ef36cc178bc356aAffected
7e83ccbecd608b971f340e951c9e84cd0343002f to before 99b503e4edc5938885d839cf0e7571963f75d800Affected
7e83ccbecd608b971f340e951c9e84cd0343002f to before 9e9efc77efd1956cc244af975240f2513d78a371Affected
7e83ccbecd608b971f340e951c9e84cd0343002f to before a405c6f0229526160aa3f177f65e20c86fce84c5Affected

LinuxLinux

3.10Affected
before 3.10Not affected
4.19.283 through 4.19.*Not affected
5.4.243 through 5.4.*Not affected
5.10.180 through 5.10.*Not affected
5.15.111 through 5.15.*Not affected
6.1.28 through 6.1.*Not affected
6.2.15 through 6.2.*Not affected
6.3.2 through 6.3.*Not affected
6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.