PT-2024-14600 · Linux+2 · Linux Kernel+2

Wang Xuerui · Published 2024-03-02 · Updated 2025-10-13 · CVE-2023-52506

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.5.0 and earlier

Description The Linux kernel has a vulnerability that can cause a panic when DEFERRED STRUCT PAGE INIT is enabled. This occurs after a specific commit, where the node ID is set to MAX NUMNODES, resulting in a NULL dereference in the call chain reserve bootmem region() -> init reserved page(). The issue arises from early memblock reserve() in memblock init() and can be avoided by setting all reserved memblocks on Node#0 at initialization.

Recommendations For Linux kernel version 6.5.0 and earlier, update to a newer version that includes the fix for this vulnerability. If updating is not possible, consider applying a patch that sets all reserved memblocks on Node#0 at initialization to avoid the panic.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-12938

CVE-2023-52506

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52506.json · Exploit
• https://git.kernel.org/stable/c/19878758accf6b2788091a771d9f9fee7bab11ab · Patch
• https://git.kernel.org/stable/c/f105e893a8edd48bdf4bef9fef845a9ff402f737 · Patch
• https://git.kernel.org/stable/c/b795fb9f5861ee256070d59e33130980a01fadd7 · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-52506 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-52506 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52506 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-52506 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-52506 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52506 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-52506 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12938 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52506 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-kernel-lt-13102025/?sphrase_id=1319008 · Note
• https://docs.bell-sw.com/security/cves/CVE-2023-52506 · Note