{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53531","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-10-01T11:39:39.408Z","datePublished":"2025-10-01T11:46:15.949Z","dateUpdated":"2026-05-11T19:46:46.673Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T19:46:46.673Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: fix poll request timeout handling\n\nWhen doing io_uring benchmark on /dev/nullb0, it's easy to crash the\nkernel if poll requests timeout triggered, as reported by David. [1]\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nWorkqueue: kblockd blk_mq_timeout_work\nRIP: 0010:null_timeout_rq+0x4e/0x91\nCall Trace:\n ? null_timeout_rq+0x4e/0x91\n blk_mq_handle_expired+0x31/0x4b\n bt_iter+0x68/0x84\n ? bt_tags_iter+0x81/0x81\n __sbitmap_for_each_set.constprop.0+0xb0/0xf2\n ? __blk_mq_complete_request_remote+0xf/0xf\n bt_for_each+0x46/0x64\n ? __blk_mq_complete_request_remote+0xf/0xf\n ? percpu_ref_get_many+0xc/0x2a\n blk_mq_queue_tag_busy_iter+0x14d/0x18e\n blk_mq_timeout_work+0x95/0x127\n process_one_work+0x185/0x263\n worker_thread+0x1b5/0x227\n\nThis is indeed a race problem between null_timeout_rq() and null_poll().\n\nnull_poll()\t\t\t\tnull_timeout_rq()\n  spin_lock(&nq->poll_lock)\n  list_splice_init(&nq->poll_list, &list)\n  spin_unlock(&nq->poll_lock)\n\n  while (!list_empty(&list))\n    req = list_first_entry()\n    list_del_init()\n    ...\n    blk_mq_add_to_batch()\n    // req->rq_next = NULL\n\t\t\t\t\tspin_lock(&nq->poll_lock)\n\n\t\t\t\t\t// rq->queuelist->next == NULL\n\t\t\t\t\tlist_del_init(&rq->queuelist)\n\n\t\t\t\t\tspin_unlock(&nq->poll_lock)\n\nFix these problems by setting requests state to MQ_RQ_COMPLETE under\nnq->poll_lock protection, in which null_timeout_rq() can safely detect\nthis race and early return.\n\nNote this patch just fix the kernel panic when request timeout happen.\n\n[1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/null_blk/main.c"],"versions":[{"version":"0a593fbbc245a85940ed34caa3aa1e4cb060c54b","lessThan":"a0b4a0666beacfe8add9c71d8922475541dbae73","status":"affected","versionType":"git"},{"version":"0a593fbbc245a85940ed34caa3aa1e4cb060c54b","lessThan":"a7cb2e709f2927cc3c76781df3e45de2381b3b9d","status":"affected","versionType":"git"},{"version":"0a593fbbc245a85940ed34caa3aa1e4cb060c54b","lessThan":"5a26e45edb4690d58406178b5a9ea4c6dcf2c105","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/null_blk/main.c"],"versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","status":"unaffected","versionType":"semver"},{"version":"6.1.54","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.5.4","lessThanOrEqual":"6.5.*","status":"unaffected","versionType":"semver"},{"version":"6.6","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.5.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.6"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a0b4a0666beacfe8add9c71d8922475541dbae73"},{"url":"https://git.kernel.org/stable/c/a7cb2e709f2927cc3c76781df3e45de2381b3b9d"},{"url":"https://git.kernel.org/stable/c/5a26e45edb4690d58406178b5a9ea4c6dcf2c105"}],"title":"null_blk: fix poll request timeout handling","x_generator":{"engine":"bippy-1.2.0"}}}}