{"cve":"CVE-2023-53820","nvd":{"published":"2025-12-09T16:17:20.760","modified":"2026-06-17T06:46:07.730","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nloop: loop_set_status_from_info() check before assignment\n\nIn loop_set_status_from_info(), lo->lo_offset and lo->lo_sizelimit should\nbe checked before reassignment, because if an overflow error occurs, the\noriginal correct value will be changed to the wrong value, and it will not\nbe changed back.\n\nMore, the original patch did not solve the problem, the value was set and\nioctl returned an error, but the subsequent io used the value in the loop\ndriver, which still caused an alarm:\n\nloop_handle_cmd\n do_req_filebacked\n  loff_t pos = ((loff_t) blk_rq_pos(rq) << 9) + lo->lo_offset;\n  lo_rw_aio\n   cmd->iocb.ki_pos = pos","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/258809bf22bf71d53247856f374f2b1d055f2fd4","https://git.kernel.org/stable/c/2ea7077748e5d7cc64f1c31342c802fe66ea7426","https://git.kernel.org/stable/c/3e7d0968203d668af6036b9f9199c7b62c8a3581","https://git.kernel.org/stable/c/4be26d553a3f1d4f54f25353d1496c562002126d","https://git.kernel.org/stable/c/6bdf4e6dfb60cbb6121ccf027d97ed2ec97c0bcb"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:16:40.427100871+00:00"},"epss":{"cve":"CVE-2023-53820","score":0.00276,"percentile":0.20103,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}