PT-2025-40718 · Linux+3 · Linux Kernel+3

Published 2023-04-18 · Updated 2025-11-19 · CVE-2023-53576

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.0-rc5lblk+ #5

Description The Linux kernel contained a flaw in the null block (null blk) driver related to the handling of queue mode settings through configfs. Specifically, the code did not adequately validate the queue mode setting when read from configfs, potentially leading to an out-of-bounds (OOPs) error when the queue mode was set to 1. This could occur when using the configfs interface to configure a null block device. The issue was triggered by a specific sequence of commands involving modprobe, mkdir, echo commands to set parameters like memory backing, blocksize, size, queue mode, and power settings.

Recommendations Update to a newer kernel version that includes the fix for this vulnerability.

Exploit

Fix

RCE

NULL Pointer Dereference

Weakness Enumeration

CWE-1288

CWE-20

CWE-476

Related Identifiers

ALSA-2025_16880

BDU:2026-01505

CESA-2024_3138

CVE-2023-53576

RHSA-2023:6583

RHSA-2023_6583

RHSA-2024:3138

RHSA-2024_3138

SUSE-SU-2025:4111-1

SUSE-SU-2025:4139-1

Affected Products

Centos

Linux Kernel

Red Hat

Suse

References · 395

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53576.json · Exploit
• https://git.kernel.org/stable/c/35e304dbcefa95237a3d6f94c007bfb10f012b17 · Patch
• https://git.kernel.org/stable/c/fd35b7bb6d5a329c427924886949ab51f210200a · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53576 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4111-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53576 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:4139-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-53576 · Vendor Advisory
• https://git.kernel.org/stable/c/651260e563d9f50827dac496dc8a0b9b23d5db1a · Patch
• https://ubuntu.com/security/CVE-2023-53576 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53576 · Security Note
• https://git.kernel.org/stable/c/63f8793ee60513a09f110ea460a6ff2c33811cdb · Patch
• https://osv.dev/vulnerability/CVE-2023-53576 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01505 · Security Note