SECUFOCUSNOW
Home›CVE index›CVE-2023-53810
Review reviewHigh

CVE-2023-53810

Linux

In the Linux kernel, the following vulnerability has been resolved: blk-mq: release crypto keyslot before reporting I/O complete Once all I/O using a blk_crypto_key has completed, filesystems can call blk_crypto_evict_key(). However, the block layer currently doesn't call blk_crypto_put_keyslot() until the request is being freed, which happens after upper layers have been told (via bio_endio()) the I/O has completed. This causes a race condition where blk_crypto_evict_key() can see 'slot_refs != 0' without there being an actual bug. This makes __blk_crypto_evict_key() hit the 'WARN_ON_ONCE(...

CVSS
7.8
EPSS
0.13%
2.73% percentile
CISA KEV
Not listed
Published
2025.12.09
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.13%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: blk-mq: release crypto keyslot before reporting I/O complete Once all I/O using a blk_crypto_key has completed, filesystems can call blk_crypto_evict_key(). However, the block layer currently doesn't call blk_crypto_put_keyslot() until the request is being freed, which happens after upper layers have been told (via bio_endio()) the I/O has completed. This causes a race condition where blk_crypto_evict_key() can see 'slot_refs != 0' without there being an actual bug. This makes __blk_crypto_evict_key() hit the 'WARN_ON_ONCE(...

Affected product and versions

Product
Linux
Affected versions
>= a892c8d52c02284076fbbacae6692aa5c5807d11 < 874bdf43b4a7dc5463c31508f62b3e42eb237b08, >= a892c8d52c02284076fbbacae6692aa5c5807d11 < d206f79d9cd658665b37ce8134c6ec849ac7af0c, >= a892c8d52c02284076fbbacae6692aa5c5807d11 < 7d206ec7a04e8545828191b6ea8b49d3ea61391f, >= a892c8d52c02284076fbbacae6692aa5c5807d11 < b278570e2c59d538216f8b656e97680188a8fba4, >= a892c8d52c02284076fbbacae6692aa5c5807d11 < 92d5d233b9ff531cf9cc36ab4251779e07adb633, >= a892c8d52c02284076fbbacae6692aa5c5807d11 < 9cd1e566676bbcb8a126acd921e4e194e6339603, >= 5.8
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available
CVE-2023-53810 — Linux | SECUFOCUS NOW