NetSight
IP …
critical9.8

CVE-2023-53116

In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmet_req_complete() An nvme target ->queue_response() operat…

Impact

In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmet_req_complete() An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpu_ref_put() is called in nvmet_req_complete(). Avoid such problem by using a local variable to save the sq pointer before calling __nvmet_req_complete(), thus avoiding dereferencing the req pointer after that function call.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.8 before 4.14.311
from 4.15 before 4.19.279
from 4.20 before 5.4.238
from 5.5 before 5.10.176
from 5.11 before 5.15.104
from 5.16 before 6.1.21

Weakness classification

CWE-416

References