CVE-2023-53791 md: fix warning for holder mismatch from export_rdev()

What is CVE-2023-53791?

CVE-2023-53791 is a vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

md: fix warning for holder mismatch from export_rdev()

Commit a1d767191096 ("md: use mddev->external to select holder in export_rdev()") fix the problem that 'claim_rdev' is used for blkdev_get_by_dev() while 'rdev' is used for blkdev_put().

However, if mddev->external is changed from 0 to 1, then 'rdev' is used for blkdev_get_by_dev() while 'claim_rdev' is used for blkdev_put(). And this problem can be reporduced reliably by following:

New file: mdadm/tests/23rdev-lifetime

devname=${dev0##*/} devt=`cat /sys/block/$devname/dev` pid="" runtime=2

clean_up_test() { pill -9 $pid echo clear > /sys/block/md0/md/array_state }

trap 'clean_up_test' EXIT

add_by_sysfs() { while true; do echo $devt > /sys/block/md0/md/new_dev done }

remove_by_sysfs(){ while true; do echo remove > /sys/block/md0/md/dev-${devname}/state done }

echo md0 > /sys/module/md_mod/parameters/new_array || die "create md0 failed"

add_by_sysfs & pid="$pid $!"

remove_by_sysfs & pid="$pid $!"

sleep $runtime exit 0

Test cmd:

./test --save-logs --logdir=/tmp/ --keep-going --dev=loop --tests=23rdev-lifetime

Test result:

------------[ cut here ]------------ WARNING: CPU: 0 PID: 960 at block/bdev.c:618 blkdev_put+0x27c/0x330 Modules linked in: multipath md_mod loop CPU: 0 PID: 960 Comm: test Not tainted 6.5.0-rc2-00121-g01e55c376936-dirty #50 RIP: 0010:blkdev_put+0x27c/0x330 Call Trace: <TASK> export_rdev.isra.23+0x50/0xa0 [md_mod] mddev_unlock+0x19d/0x300 [md_mod] rdev_attr_store+0xec/0x190 [md_mod] sysfs_kf_write+0x52/0x70 kernfs_fop_write_iter+0x19a/0x2a0 vfs_write+0x3b5/0x770 ksys_write+0x74/0x150 __x64_sys_write+0x22/0x30 do_syscall_64+0x40/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fix the problem by recording if 'rdev' is used as holder.

Which versions are affected by CVE-2023-53791?

How do I fix CVE-2023-53791?

Apply the vendor's patch.

Is CVE-2023-53791 being exploited?

There is no known exploitation of CVE-2023-53791 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2023-53791, DEBIAN-CVE-2023-53791, GHSA-vw78-rr2v-h52q, ROOT-OS-UBUNTU-2204-CVE-2023-53791, UBUNTU-CVE-2023-53791.