CVE-2023-52980 block: ublk: extending queue_size to fix overflow
An integer overflow in the Linux kernel ublk driver allows out-of-bounds memory access, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52980?
CVE-2023-52980 is a high-severity vulnerability in Linux kernel, published on 27 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
block: ublk: extending queue_size to fix overflow
When validating drafted SPDK ublk target, in a case that assigning large queue depth to multiqueue ublk device, ublk target would run into a weird incorrect state. During rounds of review and debug, An overflow bug was found in ublk driver.
In ublk_cmd.h, UBLK_MAX_QUEUE_DEPTH is 4096 which means each ublk queue depth can be set as large as 4096. But when setting qd for a ublk device, sizeof(struct ublk_queue) + depth * sizeof(struct ublk_io) will be larger than 65535 if qd is larger than 2728. Then queue_size is overflowed, and ublk_get_queue() references a wrong pointer position. The wrong content of ublk_queue elements will lead to out-of-bounds memory access.
Extend queue_size in ublk_device as "unsigned int".
Weakness: CWE-787
Which versions are affected by CVE-2023-52980?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52980?
Apply the vendor's patch.
Is CVE-2023-52980 being exploited?
There is no known exploitation of CVE-2023-52980 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52980, DEBIAN-CVE-2023-52980, GHSA-cq6c-crmc-xmvp, UBUNTU-CVE-2023-52980.