PT-2025-40769 · Linux+1 · Linux Kernel+1

Published 2023-05-09 · Updated 2026-02-05 · CVE-2023-53606

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel has a flaw related to the handling of nfsd file reference counts within the Network File System (NFS) copy codepath. Specifically, there is a potential for reference count leaks when copying files. The issue arises from the existence of two different structures for nfsd4 copy, one embedded and one dynamically allocated. If the kthread create function fails during the copy process, references to the source and destination nfsd files are leaked. The cleanup process for asynchronous copies is complex, involving multiple references that are not always properly managed. The recommended change involves ensuring that nfsd file references for the embedded copy structure are cleaned up before nfsd4 copy returns, reworking the cleanup async copy function to handle both intra and inter copies, and eliminating the nfsd4 cleanup intra ssc function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

ALSA-2025_16880

CVE-2023-53606

RHSA-2023:2458

RHSA-2023_2458

Affected Products

Linux Kernel

Red Hat

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53606.json · Exploit
• https://ubuntu.com/security/CVE-2023-53606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53606 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-53606 · Vendor Advisory
• https://git.kernel.org/stable/c/fd63299db8090307eae66f2aef17c8f00aafa0a9 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53606 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-53606 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53606 · Security Note
• https://git.kernel.org/stable/c/6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f · Patch
• https://git.kernel.org/stable/c/b3169b6ffe036b549c296a9e71591d29a1fb3209 · Patch
• https://git.kernel.org/stable/c/75b8c681c563ef7e85da6862354efc18d2a08b1b · Patch
• https://osv.dev/vulnerability/BELL-CVE-2023-53606 · Vendor Advisory
• https://git.kernel.org/stable/c/8f565846fbe8182961498d4cbe618b15076a683b · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53606 · Vendor Advisory
• https://t.me/cveNotify/151007 · Telegram Post