CVE-2023-53511

published 2025-10-01

CVE-2023-53511: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix fget leak when fs don't support nowait buffered read Heming reported a BUG…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix fget leak when fs don't support nowait buffered read

Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1]

Do the following steps can reproduce this BUG:
mount -t ocfs2 /dev/vdc /mnt/ocfs2
cp testfile /mnt/ocfs2/
./link-cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1
umount /mnt/ocfs2

Then umount will fail, and it outputs:
umount: /mnt/ocfs2: target is busy.

While tracing umount, it blames mnt_get_count() not return as expected.
Do a deep investigation for fget()/fput() on related code flow, I've
finally found that fget() leaks since ocfs2 doesn't support nowait
buffered read.

io_issue_sqe
|-io_assign_file // do fget() first
|-io_read
|-io_iter_do_read
|-ocfs2_file_read_iter // return -EOPNOTSUPP
|-kiocb_done
|-io_rw_done
|-__io_complete_rw_common // set REQ_F_REISSUE
|-io_resubmit_prep
|-io_req_prep_async // override req->file, leak happens

This was introduced by commit a196c78b5443 in v5.18. Fix it by don't
re-assign req->file if it has already been assigned.

[1] https://lore.kernel.org/ocfs2-devel/[email protected]/T/#t

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.20-1 (bookworm)	linux 6.1.20-1 (bookworm)
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 5.17.9 < 5.18	5.18
linux	linux	>= a196c78b5443fc61af2c0490213b9d125482cbd1 < 75a499fc9d66a32271e2b3e4ca71156e8ad3b484	75a499fc9d66a32271e2b3e4ca71156e8ad3b484
linux	linux	>= a196c78b5443fc61af2c0490213b9d125482cbd1 < 10fb2e16ee6ffaf1716b9e90d007e6b300bfa457	10fb2e16ee6ffaf1716b9e90d007e6b300bfa457
linux	linux	>= a196c78b5443fc61af2c0490213b9d125482cbd1 < 54aa7f2330b82884f4a1afce0220add6e8312f8b	54aa7f2330b82884f4a1afce0220add6e8312f8b
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 5.17.9 < 5.18	5.18
linux	linux_kernel	>= 5.18.1 < 6.1.16	6.1.16
linux	linux_kernel	>= 6.2 < 6.2.3	6.2.3

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-401 CWE-772