GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53711 (GCVE-0-2023-53711)

Vulnerability from cvelistv5 – Published: 2025-10-22 13:23 – Updated: 2026-08-05 09:15
VLAI
Title
NFS: Fix a potential data corruption
Summary
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential data corruption We must ensure that the subrequests are joined back into the head before we can retransmit a request. If the head was not on the commit lists, because the server wrote it synchronously, we still need to add it back to the retransmission list. Add a call that mirrors the effect of nfs_cancel_remove_inode() for O_DIRECT.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ed5d588fe47feef290f271022820e255d8371561 , < 4185605cd0f72ec8bf8b423aacd94cd5ee13bbcf (git)
Affected: ed5d588fe47feef290f271022820e255d8371561 , < da302f1d476a44245823a74546debb5d160bf5bd (git)
Affected: ed5d588fe47feef290f271022820e255d8371561 , < dac14a1dbe20e003215dacb8a3a1a7e4ca4e0ad0 (git)
Affected: ed5d588fe47feef290f271022820e255d8371561 , < 0ec26716e45d615edfff46012e7dedcc0ac5f7ab (git)
Affected: ed5d588fe47feef290f271022820e255d8371561 , < 88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.10.195 , ≤ 5.10.* (semver)
Unaffected: 5.15.132 , ≤ 5.15.* (semver)
Unaffected: 6.1.54 , ≤ 6.1.* (semver)
Unaffected: 6.5.4 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/direct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4185605cd0f72ec8bf8b423aacd94cd5ee13bbcf",
              "status": "affected",
              "version": "ed5d588fe47feef290f271022820e255d8371561",
              "versionType": "git"
            },
            {
              "lessThan": "da302f1d476a44245823a74546debb5d160bf5bd",
              "status": "affected",
              "version": "ed5d588fe47feef290f271022820e255d8371561",
              "versionType": "git"
            },
            {
              "lessThan": "dac14a1dbe20e003215dacb8a3a1a7e4ca4e0ad0",
              "status": "affected",
              "version": "ed5d588fe47feef290f271022820e255d8371561",
              "versionType": "git"
            },
            {
              "lessThan": "0ec26716e45d615edfff46012e7dedcc0ac5f7ab",
              "status": "affected",
              "version": "ed5d588fe47feef290f271022820e255d8371561",
              "versionType": "git"
            },
            {
              "lessThan": "88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4",
              "status": "affected",
              "version": "ed5d588fe47feef290f271022820e255d8371561",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/direct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.195",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.132",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.54",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.4",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix a potential data corruption\n\nWe must ensure that the subrequests are joined back into the head before\nwe can retransmit a request. If the head was not on the commit lists,\nbecause the server wrote it synchronously, we still need to add it back\nto the retransmission list.\nAdd a call that mirrors the effect of nfs_cancel_remove_inode() for\nO_DIRECT."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug lives in the NFS client\u0027s O_DIRECT write path and is driven entirely by data from a remote peer \u2014 the server\u0027s per-WRITE `committed` level, the negotiated wsize that forces the page-group split, and the COMMIT write verifier that triggers `nfs_direct_write_reschedule()`. A malicious/compromised NFS server or an on-path attacker on unauthenticated AUTH_SYS NFS traffic reaches it over the network with no local access.\nAC:L - All three preconditions are server-controlled and can be produced deterministically and repeatedly: advertise a wsize that forces `__nfs_pageio_add_request()` to split a request into head+subrequest across two RPCs, answer one FILE_SYNC and the other UNSTABLE so only the subrequest lands on the commit list, then return a changed write verifier on COMMIT to force the reschedule.\nPR:N - The attacker is the remote NFS server (or an on-path attacker), which needs no credentials or privileges on the victim client; the vulnerable path runs in the client\u0027s normal write-completion/reschedule machinery.\nUI:N - No victim action is required beyond an already-mounted export carrying an ordinary O_DIRECT workload \u2014 the databases, VM images and backup jobs NFS O_DIRECT exists for. The reschedule runs asynchronously from `nfsiod` with no user involvement.\nS:U - The defect and its consequences are confined to the NFS client within the same kernel security authority; no VM, sandbox, or IOMMU boundary is crossed.\nC:N - Tracing the path shows no out-of-bounds read, no kernel-memory disclosure and no read primitive \u2014 subrequests hold krefs on the head and `nfs_page_group_destroy()`\u0027s deferred teardown prevents any use-after-free. The impact is confined to what gets written back.\nI:H - Retransmitting subrequests without rejoining them to the head means an O_DIRECT write is not faithfully re-driven to stable storage after the server discards its unstable cache, so file contents silently diverge from what the application wrote while `write()` still reports success \u2014 unbounded, undetected corruption of stored data on a shared network filesystem.\nA:L - The un-joined group never collapses, so each attacker-forced reschedule round re-splits requests and grafts more members onto a page-group ring that cannot be reclaimed until the whole dreq dies, degrading memory and lengthening the O(N) ring walks while the write fails to converge. I found no reachable panic, BUG_ON, or hang, so this is degradation rather than a full availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:15:39.362Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4185605cd0f72ec8bf8b423aacd94cd5ee13bbcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/da302f1d476a44245823a74546debb5d160bf5bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/dac14a1dbe20e003215dacb8a3a1a7e4ca4e0ad0"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ec26716e45d615edfff46012e7dedcc0ac5f7ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4"
        }
      ],
      "title": "NFS: Fix a potential data corruption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53711",
    "datePublished": "2025-10-22T13:23:46.458Z",
    "dateReserved": "2025-10-22T13:21:37.346Z",
    "dateUpdated": "2026-08-05T09:15:39.362Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53711",
      "date": "2026-09-19",
      "epss": "0.00361",
      "percentile": "0.2993"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfs/direct.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4185605cd0f72ec8bf8b423aacd94cd5ee13bbcf",
                    "status": "affected",
                    "version": "ed5d588fe47feef290f271022820e255d8371561",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "da302f1d476a44245823a74546debb5d160bf5bd",
                    "status": "affected",
                    "version": "ed5d588fe47feef290f271022820e255d8371561",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dac14a1dbe20e003215dacb8a3a1a7e4ca4e0ad0",
                    "status": "affected",
                    "version": "ed5d588fe47feef290f271022820e255d8371561",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0ec26716e45d615edfff46012e7dedcc0ac5f7ab",
                    "status": "affected",
                    "version": "ed5d588fe47feef290f271022820e255d8371561",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4",
                    "status": "affected",
                    "version": "ed5d588fe47feef290f271022820e255d8371561",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfs/direct.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.7"
                  },
                  {
                    "lessThan": "5.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.195",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.132",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.5.*",
                    "status": "unaffected",
                    "version": "6.5.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.6",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix a potential data corruption\n\nWe must ensure that the subrequests are joined back into the head before\nwe can retransmit a request. If the head was not on the commit lists,\nbecause the server wrote it synchronously, we still need to add it back\nto the retransmission list.\nAdd a call that mirrors the effect of nfs_cancel_remove_inode() for\nO_DIRECT."
          }
        ],
        "id": "CVE-2023-53711",
        "lastModified": "2026-08-04T10:19:18.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-10-22T14:15:45.713",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0ec26716e45d615edfff46012e7dedcc0ac5f7ab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4185605cd0f72ec8bf8b423aacd94cd5ee13bbcf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/da302f1d476a44245823a74546debb5d160bf5bd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dac14a1dbe20e003215dacb8a3a1a7e4ca4e0ad0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-21T02:37:17+00:00",
      "cve": "CVE-2023-53711",
      "id": "CVE-2023-53711",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFS: Fix a potential data corruption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53711.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:56:13Z",
      "cve": "CVE-2023-53711",
      "id": "CVE-2023-53711",
      "initial_release_date": "2025-10-28T00:48:17Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "256",
      "product_status:recommended": "535",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53711",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53711.json",
      "version": "46"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.