CVE-2023-53867
published 2025-12-24CVE-2023-53867: In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just…
PriorityP345critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.53%
44.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps and just after the 'session->s_cap_lock' is
released in ceph_iterate_session_caps() the cap maybe removed by
another thread, and when using the stale cap memory in the callbacks
it will trigger use-after-free crash.
We need to check the existence of the cap just after the 'ci->i_ceph_lock'
being acquired. And do nothing if it's already removed.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.37-1 (bookworm) | linux 6.1.37-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 2f2dc053404febedc9c273452d9d518fb31fde72 < 2b2515b8095cf2149bef44383a99d5b5677f1831 | 2b2515b8095cf2149bef44383a99d5b5677f1831 |
| linux | linux | >= 2f2dc053404febedc9c273452d9d518fb31fde72 < 448875a73e16ba7d81dec9274ce9d33a12d092fb | 448875a73e16ba7d81dec9274ce9d33a12d092fb |
| linux | linux | >= 2f2dc053404febedc9c273452d9d518fb31fde72 < ae6e935618d99cdba11eab4714092e7e5f13cf7e | ae6e935618d99cdba11eab4714092e7e5f13cf7e |
| linux | linux | >= 2f2dc053404febedc9c273452d9d518fb31fde72 < aaf67de78807c59c35bafb5003d4fb457c764800 | aaf67de78807c59c35bafb5003d4fb457c764800 |
| linux | linux_kernel | >= 0 < 6.1.37-1 | 6.1.37-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 2.6.34 < 6.1.28 | 6.1.28 |
| linux | linux_kernel | >= 6.2.0 < 6.2.15 | 6.2.15 |
| linux | linux_kernel | >= 6.3.0 < 6.3.2 | 6.3.2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f688-j3hq-jm53: In the Linux kernel, the following vulnerability has been resolved:
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps
ghsa_unreviewed·2025-12-24
CVE-2023-53867 GHSA-f688-j3hq-jm53: In the Linux kernel, the following vulnerability has been resolved:
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps and just after the 'session->s_cap_lock' is
released in ceph_iterate_session_caps() the cap maybe removed by
another thread, and when using the stale cap memory in the callbacks
it will trigger use-after-free crash.
We need to check the existence of the cap just after the 'ci->i_ceph_lock'
being acquired. And do nothing if it's already removed.
OSV
ceph: fix potential use-after-free bug when trimming caps
osv·2025-12-24
CVE-2023-53867 ceph: fix potential use-after-free bug when trimming caps
ceph: fix potential use-after-free bug when trimming caps
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps and just after the 'session->s_cap_lock' is
released in ceph_iterate_session_caps() the cap maybe removed by
another thread, and when using the stale cap memory in the callbacks
it will trigger use-after-free crash.
We need to check the existence of the cap just after the 'ci->i_ceph_lock'
being acquired. And do nothing if it's already removed.
OSV
CVE-2023-53867: In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps a
osv·2025-12-24
CVE-2023-53867 CVE-2023-53867: In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps a
In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just after the 'session->s_cap_lock' is released in ceph_iterate_session_caps() the cap maybe removed by another thread, and when using the stale cap memory in the callbacks it will trigger use-after-free crash. We need to check the existence of the cap just after the 'ci->i_ceph_lock' being acquired. And do nothing if it's already removed.
Red Hat
kernel: ceph: fix potential use-after-free bug when trimming caps
vendor_redhat·2025-12-24·CVSS 5.5
CVE-2023-53867 [LOW] CWE-367 kernel: ceph: fix potential use-after-free bug when trimming caps
kernel: ceph: fix potential use-after-free bug when trimming caps
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps and just after the 'session->s_cap_lock' is
released in ceph_iterate_session_caps() the cap maybe removed by
another thread, and when using the stale cap memory in the callbacks
it will trigger use-after-free crash.
We need to check the existence of the cap just after the 'ci->i_ceph_lock'
being acquired. And do nothing if it's already removed.
A use-after-free vulnerability was found in the Linux kernel's Ceph filesystem client. When iterating over session caps in ceph_iterate_session_caps(), the session->s_cap_lock is released temporarily, allowing another thread to remove t
Debian
CVE-2023-53867: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: fix p...
vendor_debian·2023
CVE-2023-53867 CVE-2023-53867: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: fix p...
In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just after the 'session->s_cap_lock' is released in ceph_iterate_session_caps() the cap maybe removed by another thread, and when using the stale cap memory in the callbacks it will trigger use-after-free crash. We need to check the existence of the cap just after the 'ci->i_ceph_lock' being acquired. And do nothing if it's already removed.
Scope: local
bookworm: resolved (fixed in 6.1.37-1)
bullseye: open
forky: resolved (fixed in 6.3.7-1)
sid: resolved (fixed in 6.3.7-1)
trixie: resolved (fixed in 6.3.7-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-53867 kernel: ceph: fix potential use-after-free bug when trimming caps
bugzilla·2025-12-24
CVE-2023-53867 [LOW] CVE-2023-53867 kernel: ceph: fix potential use-after-free bug when trimming caps
CVE-2023-53867 kernel: ceph: fix potential use-after-free bug when trimming caps
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps and just after the 'session->s_cap_lock' is
released in ceph_iterate_session_caps() the cap maybe removed by
another thread, and when using the stale cap memory in the callbacks
it will trigger use-after-free crash.
We need to check the existence of the cap just after the 'ci->i_ceph_lock'
being acquired. And do nothing if it's already removed.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025122422-CVE-2023-53867-cb3e@gregkh/T
Wiz
CVE-2023-53867 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-53867 CVE-2023-53867 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-53867 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps and just after the 'session->s_cap_lock' is
released in ceph_iterate_session_caps() the cap maybe removed by
another thread, and when using the stale cap memory in the callbacks
it will trigger use-after-free crash.
We need to check the existence of the cap just after the 'ci->i_ceph_lock'
being acquired. And do nothing if it's already removed.
Source : NVD
Published December 24, 2025
CNA Score N/A
Affected Technologies
Linux Kernel
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probabi
2025-12-24
Published