CVE-2023-52787

Summary

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: make sure active queue usage is held for bio_integrity_prep()

blk_integrity_unregister() can come if queue usage counter isn't held for one bio with integrity prepared, so this request may be completed with calling profile->complete_fn, then kernel panic.

Another constraint is that bio_integrity_prep() needs to be called before bio merge.

Fix the issue by:

  • call bio_integrity_prep() with one queue usage counter grabbed reliably

  • call bio_integrity_prep() before bio merge

Affected Software

VendorProductVersion RangeStatus
LinuxLinux900e080752025f0016128f07c9ed4c50eba3654b < b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9affected
LinuxLinux900e080752025f0016128f07c9ed4c50eba3654b < e9c309ded295b7f8849097d71ae231456ca79f78affected
LinuxLinux900e080752025f0016128f07c9ed4c50eba3654b < b80056bd75a16e4550873ecefe12bc8fd190b1cfaffected
LinuxLinux900e080752025f0016128f07c9ed4c50eba3654b < b0077e269f6c152e807fdac90b58caf012cdbaabaffected
LinuxLinux5.16affected
LinuxLinux0 < 5.16unaffected
LinuxLinux6.1.72 <= 6.1.*unaffected
LinuxLinux6.5.13 <= 6.5.*unaffected
LinuxLinux6.6.3 <= 6.6.*unaffected
LinuxLinux6.7 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References