CVE-2023-53665

md: don't dereference mddev after export_rdev()

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

md: don't dereference mddev after export_rdev()

Except for initial reference, mddev->kobject is referenced by rdev->kobject, and if the last rdev is freed, there is no guarantee that mddev is still valid. Hence mddev should not be used anymore after export_rdev().

This problem can be triggered by following test for mdadm at very low rate:

New file: mdadm/tests/23rdev-lifetime

devname=${dev0##*/} devt=cat /sys/block/$devname/dev pid="" runtime=2

clean_up_test() { pill -9 $pid echo clear > /sys/block/md0/md/array_state }

trap 'clean_up_test' EXIT

add_by_sysfs() { while true; do echo $devt > /sys/block/md0/md/new_dev done }

remove_by_sysfs(){ while true; do echo remove > /sys/block/md0/md/dev-${devname}/state done }

echo md0 > /sys/module/md_mod/parameters/new_array || die "create md0 failed"

add_by_sysfs & pid="$pid $!"

remove_by_sysfs & pid="$pid $!"

sleep $runtime exit 0

Test cmd:

./test --save-logs --logdir=/tmp/ --keep-going --dev=loop --tests=23rdev-lifetime

Test result:

general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bcb: 0000 [#4] PREEMPT SMP CPU: 0 PID: 1292 Comm: test Tainted: G D W 6.5.0-rc2-00121-g01e55c376936 #562 RIP: 0010:md_wakeup_thread+0x9e/0x320 [md_mod] Call Trace: <TASK> mddev_unlock+0x1b6/0x310 [md_mod] rdev_attr_store+0xec/0x190 [md_mod] sysfs_kf_write+0x52/0x70 kernfs_fop_write_iter+0x19a/0x2a0 vfs_write+0x3b5/0x770 ksys_write+0x74/0x150 __x64_sys_write+0x22/0x30 do_syscall_64+0x40/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fix this problem by don't dereference mddev after export_rdev().

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.13%Up 0.1 points since Oct 8, 2025

What each source reports

NVD Score used5.5

In the Linux kernel, the following vulnerability has been resolved:

md: don't dereference mddev after export_rdev()

This problem can be triggered by following test for mdadm at very low rate:

New file: mdadm/tests/23rdev-lifetime

devname=${dev0##*/} devt=cat /sys/block/$devname/dev pid="" runtime=2

clean_up_test() { pill -9 $pid echo clear > /sys/block/md0/md/array_state }

trap 'clean_up_test' EXIT

add_by_sysfs() { while true; do echo $devt > /sys/block/md0/md/new_dev done }

remove_by_sysfs(){ while true; do echo remove > /sys/block/md0/md/dev-${devname}/state done }

echo md0 > /sys/module/md_mod/parameters/new_array || die "create md0 failed"

add_by_sysfs & pid="$pid $!"

remove_by_sysfs & pid="$pid $!"

sleep $runtime exit 0

Test cmd:

./test --save-logs --logdir=/tmp/ --keep-going --dev=loop --tests=23rdev-lifetime

Test result:

Fix this problem by don't dereference mddev after export_rdev().

Record: CVE-2023-53665
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

CVE ListNo score

md: don't dereference mddev after export_rdev()

In the Linux kernel, the following vulnerability has been resolved:

md: don't dereference mddev after export_rdev()

This problem can be triggered by following test for mdadm at very low rate:

New file: mdadm/tests/23rdev-lifetime

devname=${dev0##*/} devt=cat /sys/block/$devname/dev pid="" runtime=2

clean_up_test() { pill -9 $pid echo clear > /sys/block/md0/md/array_state }

trap 'clean_up_test' EXIT

add_by_sysfs() { while true; do echo $devt > /sys/block/md0/md/new_dev done }

remove_by_sysfs(){ while true; do echo remove > /sys/block/md0/md/dev-${devname}/state done }

echo md0 > /sys/module/md_mod/parameters/new_array || die "create md0 failed"

add_by_sysfs & pid="$pid $!"

remove_by_sysfs & pid="$pid $!"

sleep $runtime exit 0

Test cmd:

./test --save-logs --logdir=/tmp/ --keep-going --dev=loop --tests=23rdev-lifetime

Test result:

Fix this problem by don't dereference mddev after export_rdev().

Record: CVE-2023-53665
Updated: 2026-11-02

EUVDEUVD-2025-31974No score

In the Linux kernel, the following vulnerability has been resolved:

md: don't dereference mddev after export_rdev()

This problem can be triggered by following test for mdadm at very low rate:

New file: mdadm/tests/23rdev-lifetime

devname=${dev0##*/} devt=cat /sys/block/$devname/dev pid="" runtime=2

clean_up_test() { pill -9 $pid echo clear > /sys/block/md0/md/array_state }

trap 'clean_up_test' EXIT

add_by_sysfs() { while true; do echo $devt > /sys/block/md0/md/new_dev done }

remove_by_sysfs(){ while true; do echo remove > /sys/block/md0/md/dev-${devname}/state done }

echo md0 > /sys/module/md_mod/parameters/new_array || die "create md0 failed"

add_by_sysfs & pid="$pid $!"

remove_by_sysfs & pid="$pid $!"

sleep $runtime exit 0

Test cmd:

./test --save-logs --logdir=/tmp/ --keep-going --dev=loop --tests=23rdev-lifetime

Test result:

Fix this problem by don't dereference mddev after export_rdev().

Record: EUVD-2025-31974
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3wc5-j3q5-m2xc5.5

In the Linux kernel, the following vulnerability has been resolved: md: don't dereference mddev...

In the Linux kernel, the following vulnerability has been resolved:

md: don't dereference mddev after export_rdev()

This problem can be triggered by following test for mdadm at very low rate:

New file: mdadm/tests/23rdev-lifetime

devname=${dev0##*/} devt=cat /sys/block/$devname/dev pid="" runtime=2

clean_up_test() { pill -9 $pid echo clear > /sys/block/md0/md/array_state }

trap 'clean_up_test' EXIT

add_by_sysfs() { while true; do echo $devt > /sys/block/md0/md/new_dev done }

remove_by_sysfs(){ while true; do echo remove > /sys/block/md0/md/dev-${devname}/state done }

echo md0 > /sys/module/md_mod/parameters/new_array || die "create md0 failed"

add_by_sysfs & pid="$pid $!"

remove_by_sysfs & pid="$pid $!"

sleep $runtime exit 0

Test cmd:

./test --save-logs --logdir=/tmp/ --keep-going --dev=loop --tests=23rdev-lifetime

Test result:

Fix this problem by don't dereference mddev after export_rdev().

Record: GHSA-3wc5-j3q5-m2xc
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2023-536655.5

Record: BELL-CVE-2023-53665
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-536655.5

In the Linux kernel, the following vulnerability has been resolved: md: don't dereference mddev after export_rdev() Except for initial reference, mddev->kobject is referenced by rdev->kobject, and if the last rdev is freed, there is no guarantee that mddev is still valid. Hence mddev should not be used anymore after export_rdev(). This problem can be triggered by following test for mdadm at very low rate: New file: mdadm/tests/23rdev-lifetime devname=${dev0##*/} devt=cat /sys/block/$devname/dev pid="" runtime=2 clean_up_test() { pill -9 $pid echo clear > /sys/block/md0/md/array_state } trap 'clean_up_test' EXIT add_by_sysfs() { while true; do echo $devt > /sys/block/md0/md/new_dev done } remove_by_sysfs(){ while true; do echo remove > /sys/block/md0/md/dev-${devname}/state done } echo md0 > /sys/module/md_mod/parameters/new_array || die "create md0 failed" add_by_sysfs & pid="$pid $!" remove_by_sysfs & pid="$pid $!" sleep $runtime exit 0 Test cmd: ./test --save-logs --logdir=/tmp/ --keep-going --dev=loop --tests=23rdev-lifetime Test result: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bcb: 0000 [#4] PREEMPT SMP CPU: 0 PID: 1292 Comm: test Tainted: G D W 6.5.0-rc2-00121-g01e55c376936 #562 RIP: 0010:md_wakeup_thread+0x9e/0x320 [md_mod] Call Trace: <TASK> mddev_unlock+0x1b6/0x310 [md_mod] rdev_attr_store+0xec/0x190 [md_mod] sysfs_kf_write+0x52/0x70 kernfs_fop_write_iter+0x19a/0x2a0 vfs_write+0x3b5/0x770 ksys_write+0x74/0x150 __x64_sys_write+0x22/0x30 do_syscall_64+0x40/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fix this problem by don't dereference mddev after export_rdev().

Record: DEBIAN-CVE-2023-53665
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 14 moreShow less

OSVRHSA-2024:23947.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2024:2394
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-536655.5

Record: UBUNTU-CVE-2023-53665
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVCLSA-2026-1767864313No score

kernel: Fix of 46 CVEs

mm: hugetlb: fix UAF in hugetlb_handle_userfault {CVE-2022-50630}
drm/amdkfd: fix potential kgd_mem UAFs {CVE-2023-53816}
net/mlx5e: Fix deadlock in tc route query code {CVE-2023-53591}
PCI: Fix pci_device_is_present() for VFs by checking PF {CVE-2022-50636}
wifi: ath11k: fix monitor mode bringup crash {CVE-2022-50627}
wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
scsi: target: iscsi: Fix timeout on deleted connection {CVE-2025-38075}
amdgpu: validate offset_in_bo of drm_amdgpu_gem_va {CVE-2023-53819}
dmaengine: ptdma: check for null desc before calling pt_cmd_callback {CVE-2023-53755}
wifi: mt7601u: fix an integer underflow {CVE-2023-53679}
Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087}
tls: wait for pending async decryptions if tls_strp_msg_hold fails {CVE-2025-40176}
clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns {CVE-2025-38499}
net: openvswitch: reject negative ifindex {CVE-2023-53843}
drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
iommu/amd: Improve page fault error reporting {CVE-2023-53789}
media: v4l2-mem2mem: add lock to protect parameter num_rdy {CVE-2023-53519}
Bluetooth: Fix potential use-after-free when clear keys {CVE-2023-53386}
Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
ext4: fix use-after-free in ext4_orphan_cleanup {CVE-2022-50673}
cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
rxrpc: Make it so that a waiting process can be aborted {CVE-2023-53218}
ip6_vti: fix slab-use-after-free in decode_session6 {CVE-2023-53821}
vxlan: Fix nexthop hash size {CVE-2023-53192}
wifi: mac80211: check S1G action frame size {CVE-2023-53257}
wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279}
dm flakey: fix a crash with invalid table line {CVE-2023-53786}
md/raid10: fix null-ptr-deref in raid10_sync_request {CVE-2023-53832}
md: don't dereference mddev after export_rdev() {CVE-2023-53665}
md: fix 'delete_mutex' deadlock
md: fix duplicate filename for rdev {CVE-2023-53665}
kernfs: Fix UAF in polling when open file is released {CVE-2025-39881}
mptcp: pm: avoid possible UaF when selecting endp {CVE-2024-44974}
mptcp: fix UaF in listener shutdown {CVE-2023-53088}
Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981}
Bluetooth: hci_sync: fix set_local_name race condition
Bluetooth: MGMT: Fix possible deadlocks {CVE-2024-53207}
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-40186}
e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898}
wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864}
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
xfrm: xfrm_alloc_spi shouldn't use 0 as SPI {CVE-2025-39965}
xfrm: Duplicate SPI Handling {CVE-2025-39797}
nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
NFS: Fix a race when updating an existing write {CVE-2025-39697}
nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests
drm/amd/display: Check dce_hwseq before dereferencing it {CVE-2025-38361}

Record: CLSA-2026-1767864313
Updated: 2026-11-02

OSVNo score

md: don't dereference mddev after export_rdev()

In the Linux kernel, the following vulnerability has been resolved:

md: don't dereference mddev after export_rdev()

This problem can be triggered by following test for mdadm at very low rate:

New file: mdadm/tests/23rdev-lifetime

devname=${dev0##*/} devt=cat /sys/block/$devname/dev pid="" runtime=2

clean_up_test() { pill -9 $pid echo clear > /sys/block/md0/md/array_state }

trap 'clean_up_test' EXIT

add_by_sysfs() { while true; do echo $devt > /sys/block/md0/md/new_dev done }

remove_by_sysfs(){ while true; do echo remove > /sys/block/md0/md/dev-${devname}/state done }

echo md0 > /sys/module/md_mod/parameters/new_array || die "create md0 failed"

add_by_sysfs & pid="$pid $!"

remove_by_sysfs & pid="$pid $!"

sleep $runtime exit 0

Test cmd:

./test --save-logs --logdir=/tmp/ --keep-going --dev=loop --tests=23rdev-lifetime

Test result:

Fix this problem by don't dereference mddev after export_rdev().

Record: CVE-2023-53665
Updated: 2026-11-02

OSVSUSE-SU-2025:21040-1No score