PT-2025-38366 · Linux+1 · Linux Kernel+1

Published 2025-09-18 · Updated 2026-04-20 · CVE-2023-53387

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the UFS error handling flow within the Linux kernel. Specifically, if a device management command (NOP OUT) times out during link recovery and clearing the doorbell fails, the ufshcd wait for dev cmd() function may return without properly resetting the complete structure. Subsequently, if the command is completed by the device, calling complete() within ufshcd transfer req compl() can lead to a crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2026-06026

CVE-2023-53387

RHSA-2023:6583

Affected Products

Debian

Linux Kernel

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53387.json · Exploit
• https://git.kernel.org/stable/c/3ffd2cd644e0f1eea01339831bac4b1054e8817c · Patch
• https://git.kernel.org/stable/c/36822124f9de200cedc2f42516301b50d386a6cd · Patch
• https://cve.org/CVERecord?id=CVE-2023-53387 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-53387 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53387 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53387 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-53387 · Vendor Advisory
• https://git.kernel.org/stable/c/cf45493432704786a0f8294c7723ad4eeb5fff24 · Patch
• https://ubuntu.com/security/CVE-2023-53387 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-53387 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2023-53387 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06026 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53387 · Vendor Advisory
• https://t.me/msrcreports/2575 · Telegram Post