CVE-2023-53643
published 2025-10-07CVE-2023-53643: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: don't access released socket during error recovery While the error recovery work…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.15%
4.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: don't access released socket during error recovery
While the error recovery work is temporarily failing reconnect attempts,
running the 'nvme list' command causes a kernel NULL pointer dereference
by calling getsockname() with a released socket.
During error recovery work, the nvme tcp socket is released and a new one
created, so it is not safe to access the socket without proper check.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.20-1 (bookworm) | linux 6.1.20-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 02c57a82c0081141abc19150beab48ef47f97f18 < fe2d9e54165dadaa0d0cc3355c0be9c3e129fa0d | fe2d9e54165dadaa0d0cc3355c0be9c3e129fa0d |
| linux | linux | >= 02c57a82c0081141abc19150beab48ef47f97f18 < d82f762db4776fa11de88018f0f5de2d5db72a72 | d82f762db4776fa11de88018f0f5de2d5db72a72 |
| linux | linux | >= 02c57a82c0081141abc19150beab48ef47f97f18 < 76d54bf20cdcc1ed7569a89885e09636e9a8d71d | 76d54bf20cdcc1ed7569a89885e09636e9a8d71d |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 6.1 < 6.1.18 | 6.1.18 |
| linux | linux_kernel | >= 6.2 < 6.2.5 | 6.2.5 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: nvme-tcp: don't access released socket during error recovery
vendor_redhat·2025-10-07·CVSS 5.5
CVE-2023-53643 [MEDIUM] CWE-825 kernel: nvme-tcp: don't access released socket during error recovery
kernel: nvme-tcp: don't access released socket during error recovery
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: don't access released socket during error recovery
While the error recovery work is temporarily failing reconnect attempts,
running the 'nvme list' command causes a kernel NULL pointer dereference
by calling getsockname() with a released socket.
During error recovery work, the nvme tcp socket is released and a new one
created, so it is not safe to access the socket without proper check.
A race condition leading to NULL pointer dereference was found in the Linux kernel NVMe-over-TCP driver's error recovery handling. A local user with privileges to execute NVMe management commands can run the 'nvme list' command while NVMe-over-TCP error recover
Debian
CVE-2023-53643: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: d...
vendor_debian·2023·CVSS 5.5
CVE-2023-53643 [MEDIUM] CVE-2023-53643: linux - In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: d...
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: don't access released socket during error recovery While the error recovery work is temporarily failing reconnect attempts, running the 'nvme list' command causes a kernel NULL pointer dereference by calling getsockname() with a released socket. During error recovery work, the nvme tcp socket is released and a new one created, so it is not safe to access the socket without proper check.
Scope: local
bookworm: resolved (fixed in 6.1.20-1)
bullseye: resolved
forky: resolved (fixed in 6.1.20-1)
sid: resolved (fixed in 6.1.20-1)
trixie: resolved (fixed in 6.1.20-1)
GHSA
GHSA-wvjj-gc57-3w9j: In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: don't access released socket during error recovery
While the error rec
ghsa_unreviewed·2025-10-07
CVE-2023-53643 [MEDIUM] CWE-476 GHSA-wvjj-gc57-3w9j: In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: don't access released socket during error recovery
While the error rec
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: don't access released socket during error recovery
While the error recovery work is temporarily failing reconnect attempts,
running the 'nvme list' command causes a kernel NULL pointer dereference
by calling getsockname() with a released socket.
During error recovery work, the nvme tcp socket is released and a new one
created, so it is not safe to access the socket without proper check.
OSV
CVE-2023-53643: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: don't access released socket during error recovery While the error recov
osv·2025-10-07·CVSS 5.5
CVE-2023-53643 [MEDIUM] CVE-2023-53643: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: don't access released socket during error recovery While the error recov
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: don't access released socket during error recovery While the error recovery work is temporarily failing reconnect attempts, running the 'nvme list' command causes a kernel NULL pointer dereference by calling getsockname() with a released socket. During error recovery work, the nvme tcp socket is released and a new one created, so it is not safe to access the socket without proper check.
No detection rules found.
No public exploits indexed.
2025-10-07
Published