{"cve":"CVE-2023-53832","nvd":{"published":"2025-12-09T16:17:22.133","modified":"2026-06-17T06:46:09.047","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix null-ptr-deref in raid10_sync_request\n\ninit_resync() inits mempool and sets conf->have_replacemnt at the beginning\nof sync, close_sync() frees the mempool when sync is completed.\n\nAfter [1] recovery might be skipped and init_resync() is called but\nclose_sync() is not. null-ptr-deref occurs with r10bio->dev[i].repl_bio.\n\nThe following is one way to reproduce the issue.\n\n  1) create a array, wait for resync to complete, mddev->recovery_cp is set\n     to MaxSector.\n  2) recovery is woken and it is skipped. conf->have_replacement is set to\n     0 in init_resync(). close_sync() not called.\n  3) some io errors and rdev A is set to WantReplacement.\n  4) a new device is added and set to A's replacement.\n  5) recovery is woken, A have replacement, but conf->have_replacemnt is\n     0. r10bio->dev[i].repl_bio will not be alloced and null-ptr-deref\n     occurs.\n\nFix it by not calling init_resync() if recovery skipped.\n\n[1] commit 7e83ccbecd60 (\"md/raid10: Allow skipping recovery when clean arrays are assembled\")","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/14964127be77884003976a392c9faa9ebaabbbe1","https://git.kernel.org/stable/c/38d33593260536840b49fd1dcac9aedfd14a9d42","https://git.kernel.org/stable/c/68695084077e3de9d3e94e09238ace2b6f246446","https://git.kernel.org/stable/c/99b503e4edc5938885d839cf0e7571963f75d800","https://git.kernel.org/stable/c/9e9efc77efd1956cc244af975240f2513d78a371"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:16:40.427100871+00:00"},"epss":{"cve":"CVE-2023-53832","score":0.00257,"percentile":0.17409,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}