CVE-2023-53614
published 2025-10-04CVE-2023-53614: In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix race with VMA iteration and mm_struct teardown exit_mmap() will tear down the…
PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.10%
0.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
mm/ksm: fix race with VMA iteration and mm_struct teardown
exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held
in write mode. Ensure that the maple tree is still valid by checking
ksm_test_exit() after taking the mmap_lock in read mode, but before the
for_each_vma() iterator dereferences a destroyed maple tree.
Since the maple tree is destroyed, the flags telling lockdep to check an
external lock has been cleared. Skip the for_each_vma() iterator to avoid
dereferencing a maple tree without the external lock flag, which would
create a lockdep warning.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.25-1 (bookworm) | linux 6.1.25-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= a5f18ba0727656bd1fe3bcdb0d563f81790f9a04 < 286b0cab31bac29960e5684f6fb331d42f03b363 | 286b0cab31bac29960e5684f6fb331d42f03b363 |
| linux | linux | >= a5f18ba0727656bd1fe3bcdb0d563f81790f9a04 < b4f664ffd8f78c05a1fd542a28bc5a11e994c014 | b4f664ffd8f78c05a1fd542a28bc5a11e994c014 |
| linux | linux | >= a5f18ba0727656bd1fe3bcdb0d563f81790f9a04 < 6db504ce55bdbc575723938fc480713c9183f6a2 | 6db504ce55bdbc575723938fc480713c9183f6a2 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 6.1 < 6.1.22 | 6.1.22 |
| linux | linux_kernel | >= 6.2 < 6.2.9 | 6.2.9 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: mm/ksm: fix race with VMA iteration and mm_struct teardown
vendor_redhat·2025-10-04·CVSS 4.7
CVE-2023-53614 [MEDIUM] CWE-362 kernel: mm/ksm: fix race with VMA iteration and mm_struct teardown
kernel: mm/ksm: fix race with VMA iteration and mm_struct teardown
In the Linux kernel, the following vulnerability has been resolved:
mm/ksm: fix race with VMA iteration and mm_struct teardown
exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held
in write mode. Ensure that the maple tree is still valid by checking
ksm_test_exit() after taking the mmap_lock in read mode, but before the
for_each_vma() iterator dereferences a destroyed maple tree.
Since the maple tree is destroyed, the flags telling lockdep to check an
external lock has been cleared. Skip the for_each_vma() iterator to avoid
dereferencing a maple tree without the external lock flag, which would
create a lockdep warning.
Statement: A race in KSM’s VMA iteration vs. exit_mmap() could dereference a torn-d
Debian
CVE-2023-53614: linux - In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix...
vendor_debian·2023·CVSS 4.7
CVE-2023-53614 [MEDIUM] CVE-2023-53614: linux - In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix...
In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix race with VMA iteration and mm_struct teardown exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held in write mode. Ensure that the maple tree is still valid by checking ksm_test_exit() after taking the mmap_lock in read mode, but before the for_each_vma() iterator dereferences a destroyed maple tree. Since the maple tree is destroyed, the flags telling lockdep to check an external lock has been cleared. Skip the for_each_vma() iterator to avoid dereferencing a maple tree without the external lock flag, which would create a lockdep warning.
Scope: local
bookworm: resolved (fixed in 6.1.25-1)
bullseye: resolved
forky: resolved (fixed in 6.1.25-1)
sid: resolved (fixed in 6.1.25-1)
trixie: res
GHSA
GHSA-m8wv-9hr6-j68w: In the Linux kernel, the following vulnerability has been resolved:
mm/ksm: fix race with VMA iteration and mm_struct teardown
exit_mmap() will tear
ghsa_unreviewed·2025-10-04
CVE-2023-53614 [MEDIUM] CWE-362 GHSA-m8wv-9hr6-j68w: In the Linux kernel, the following vulnerability has been resolved:
mm/ksm: fix race with VMA iteration and mm_struct teardown
exit_mmap() will tear
In the Linux kernel, the following vulnerability has been resolved:
mm/ksm: fix race with VMA iteration and mm_struct teardown
exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held
in write mode. Ensure that the maple tree is still valid by checking
ksm_test_exit() after taking the mmap_lock in read mode, but before the
for_each_vma() iterator dereferences a destroyed maple tree.
Since the maple tree is destroyed, the flags telling lockdep to check an
external lock has been cleared. Skip the for_each_vma() iterator to avoid
dereferencing a maple tree without the external lock flag, which would
create a lockdep warning.
OSV
CVE-2023-53614: In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix race with VMA iteration and mm_struct teardown exit_mmap() will tear d
osv·2025-10-04·CVSS 4.7
CVE-2023-53614 [MEDIUM] CVE-2023-53614: In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix race with VMA iteration and mm_struct teardown exit_mmap() will tear d
In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix race with VMA iteration and mm_struct teardown exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held in write mode. Ensure that the maple tree is still valid by checking ksm_test_exit() after taking the mmap_lock in read mode, but before the for_each_vma() iterator dereferences a destroyed maple tree. Since the maple tree is destroyed, the flags telling lockdep to check an external lock has been cleared. Skip the for_each_vma() iterator to avoid dereferencing a maple tree without the external lock flag, which would create a lockdep warning.
No detection rules found.
No public exploits indexed.
2025-10-04
Published