{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2023-53823 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2023-53823 is a high-severity vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-53823 and fix it if it is affected.\n\nWhat it is: CVE-2023-53823 is a high-severity vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-53823 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-53823/ (Markdown: https://insights.sbomify.com/CVE-2023-53823/index.md)","id":"CVE-2023-53823","markdown":"https://insights.sbomify.com/CVE-2023-53823/index.md","name":"CVE-2023-53823","record":{"aliases":["BELL-CVE-2023-53823","DEBIAN-CVE-2023-53823","GHSA-h5mg-vw9m-f6v8","ROOT-OS-DEBIAN-12-CVE-2023-53823","UBUNTU-CVE-2023-53823"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","other"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel block layer","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel block layer can cause null pointer dereferences or memory leaks, potentially leading to system crashes.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock/rq_qos: protect rq_qos apis with a new lock\n\ncommit 50e34d78815e (\"block: disable the elevator int del_gendisk\")\nmove rq_qos_exit() from disk_release() to del_gendisk(), this will\nintroduce some problems:\n\n1) If rq_qos_add() is triggered by enabling iocost/iolatency through\n   cgroupfs, then it can concurrent with del_gendisk(), it's not safe to\n   write 'q-\u003erq_qos' concurrently.\n\n2) Activate cgroup policy that is relied on rq_qos will call\n   rq_qos_add() and blkcg_activate_policy(), and if rq_qos_exit() is\n   called in the middle, null-ptr-dereference will be triggered in\n   blkcg_activate_policy().\n\n3) blkg_conf_open_bdev() can call blkdev_get_no_open() first to find the\n   disk, then if rq_qos_exit() from del_gendisk() is done before\n   rq_qos_add(), then memory will be leaked.\n\nThis patch add a new disk level mutex 'rq_qos_mutex':\n\n1) The lock will protect rq_qos_exit() directly.\n\n2) For wbt that doesn't relied on blk-cgroup, rq_qos_add() can only be\n   called from disk initialization for now because wbt can't be\n   destructed until rq_qos_exit(), so it's safe not to protect wbt for\n   now. Hoever, in case that rq_qos dynamically destruction is supported\n   in the furture, this patch also protect rq_qos_add() from wbt_init()\n   directly, this is enough because blk-sysfs already synchronize\n   writers with disk removal.\n\n3) For iocost and iolatency, in order to synchronize disk removal and\n   cgroup configuration, the lock is held after blkdev_get_no_open()\n   from blkg_conf_open_bdev(), and is released in blkg_conf_exit().\n   In order to fix the above memory leak, disk_live() is checked after\n   holding the new lock.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"block/rq_qos: protect rq_qos apis with a new lock","id":"CVE-2023-53823","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2023"},"n_packages":0,"n_references":2,"next":{"headline":"netlink: annotate lockless accesses to nlk-\u003emax_recvmsg_len","id":"CVE-2023-53824"},"packages":[],"prev":{"headline":"wifi: ath11k: Ignore frags from uninitialized peer in dp.","id":"CVE-2023-53822"},"products":["Linux"],"published":"2025-12-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A race condition in the Linux kernel block layer can cause null pointer dereferences or memory leaks, potentially leading to system crashes.","url":"https://insights.sbomify.com/CVE-2023-53823/"}