CVE-2023-53629 (GCVE-0-2023-53629)
Vulnerability from cvelistv5
Published
2025-10-07 15:19
Modified
2025-10-07 15:19
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning: [ 151.760477] ================================================================== [ 151.761803] BUG: KASAN: use-after-free in dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.763414] Read of size 4 at addr ffff88811a980c60 by task lock_torture/1347 [ 151.765284] CPU: 7 PID: 1347 Comm: lock_torture Not tainted 6.1.0-rc4+ #2828 [ 151.766778] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+16134+e5908aa2 04/01/2014 [ 151.768726] Call Trace: [ 151.769277] <TASK> [ 151.769748] dump_stack_lvl+0x5b/0x86 [ 151.770556] print_report+0x180/0x4c8 [ 151.771378] ? kasan_complete_mode_report_info+0x7c/0x1e0 [ 151.772241] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.773069] kasan_report+0x93/0x1a0 [ 151.773668] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.774514] __asan_load4+0x7e/0xa0 [ 151.775089] dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.775890] ? create_message.isra.29.constprop.64+0x57/0xc0 [ 151.776770] send_common+0x19f/0x1b0 [ 151.777342] ? remove_from_waiters+0x60/0x60 [ 151.778017] ? lock_downgrade+0x410/0x410 [ 151.778648] ? __this_cpu_preempt_check+0x13/0x20 [ 151.779421] ? rcu_lockdep_current_cpu_online+0x88/0xc0 [ 151.780292] _convert_lock+0x46/0x150 [ 151.780893] convert_lock+0x7b/0xc0 [ 151.781459] dlm_lock+0x3ac/0x580 [ 151.781993] ? 0xffffffffc0540000 [ 151.782522] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.783379] ? dlm_scan_rsbs+0xa70/0xa70 [ 151.784003] ? preempt_count_sub+0xd6/0x130 [ 151.784661] ? is_module_address+0x47/0x70 [ 151.785309] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.786166] ? 0xffffffffc0540000 [ 151.786693] ? lockdep_init_map_type+0xc3/0x360 [ 151.787414] ? 0xffffffffc0540000 [ 151.787947] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] [ 151.789004] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.789858] ? 0xffffffffc0540000 [ 151.790392] ? lock_torture_cleanup+0x20/0x20 [dlm_locktorture] [ 151.791347] ? delay_tsc+0x94/0xc0 [ 151.791898] torture_ex_iter+0xc3/0xea [dlm_locktorture] [ 151.792735] ? torture_start+0x30/0x30 [dlm_locktorture] [ 151.793606] lock_torture+0x177/0x270 [dlm_locktorture] [ 151.794448] ? torture_dlm_lock_sync.isra.3+0x150/0x150 [dlm_locktorture] [ 151.795539] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 151.796476] ? do_raw_spin_lock+0x11e/0x1e0 [ 151.797152] ? mark_held_locks+0x34/0xb0 [ 151.797784] ? _raw_spin_unlock_irqrestore+0x30/0x70 [ 151.798581] ? __kthread_parkme+0x79/0x110 [ 151.799246] ? trace_preempt_on+0x2a/0xf0 [ 151.799902] ? __kthread_parkme+0x79/0x110 [ 151.800579] ? preempt_count_sub+0xd6/0x130 [ 151.801271] ? __kasan_check_read+0x11/0x20 [ 151.801963] ? __kthread_parkme+0xec/0x110 [ 151.802630] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 151.803569] kthread+0x192/0x1d0 [ 151.804104] ? kthread_complete_and_exit+0x30/0x30 [ 151.804881] ret_from_fork+0x1f/0x30 [ 151.805480] </TASK> [ 151.806111] Allocated by task 1347: [ 151.806681] kasan_save_stack+0x26/0x50 [ 151.807308] kasan_set_track+0x25/0x30 [ 151.807920] kasan_save_alloc_info+0x1e/0x30 [ 151.808609] __kasan_slab_alloc+0x63/0x80 [ 151.809263] kmem_cache_alloc+0x1ad/0x830 [ 151.809916] dlm_allocate_mhandle+0x17/0x20 [ 151.810590] dlm_midcomms_get_mhandle+0x96/0x260 [ 151.811344] _create_message+0x95/0x180 [ 151.811994] create_message.isra.29.constprop.64+0x57/0xc0 [ 151.812880] send_common+0x129/0x1b0 [ 151.813467] _convert_lock+0x46/0x150 [ 151.814074] convert_lock+0x7b/0xc0 [ 151.814648] dlm_lock+0x3ac/0x580 [ 151.815199] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] [ 151.816258] torture_ex_iter+0xc3/0xea [dlm_locktorture] [ 151.817129] lock_t ---truncated---
References
Impacted products
Vendor Product Version
Linux Linux Version: 489d8e559c6596eb08e16447d9830bc39afbe54e
Version: 489d8e559c6596eb08e16447d9830bc39afbe54e
Version: 489d8e559c6596eb08e16447d9830bc39afbe54e
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/midcomms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3b0e9ac3c2447008db942d51f593841d8329e99",
              "status": "affected",
              "version": "489d8e559c6596eb08e16447d9830bc39afbe54e",
              "versionType": "git"
            },
            {
              "lessThan": "a2de9f9b686c71b4fa3663ae374f5f643c46a446",
              "status": "affected",
              "version": "489d8e559c6596eb08e16447d9830bc39afbe54e",
              "versionType": "git"
            },
            {
              "lessThan": "724b6bab0d75f1dc01fdfbf7fe8d4217a5cb90ba",
              "status": "affected",
              "version": "489d8e559c6596eb08e16447d9830bc39afbe54e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/midcomms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.20",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: dlm: fix use after free in midcomms commit\n\nWhile working on processing dlm message in softirq context I experienced\nthe following KASAN use-after-free warning:\n\n[  151.760477] ==================================================================\n[  151.761803] BUG: KASAN: use-after-free in dlm_midcomms_commit_mhandle+0x19d/0x4b0\n[  151.763414] Read of size 4 at addr ffff88811a980c60 by task lock_torture/1347\n\n[  151.765284] CPU: 7 PID: 1347 Comm: lock_torture Not tainted 6.1.0-rc4+ #2828\n[  151.766778] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+16134+e5908aa2 04/01/2014\n[  151.768726] Call Trace:\n[  151.769277]  \u003cTASK\u003e\n[  151.769748]  dump_stack_lvl+0x5b/0x86\n[  151.770556]  print_report+0x180/0x4c8\n[  151.771378]  ? kasan_complete_mode_report_info+0x7c/0x1e0\n[  151.772241]  ? dlm_midcomms_commit_mhandle+0x19d/0x4b0\n[  151.773069]  kasan_report+0x93/0x1a0\n[  151.773668]  ? dlm_midcomms_commit_mhandle+0x19d/0x4b0\n[  151.774514]  __asan_load4+0x7e/0xa0\n[  151.775089]  dlm_midcomms_commit_mhandle+0x19d/0x4b0\n[  151.775890]  ? create_message.isra.29.constprop.64+0x57/0xc0\n[  151.776770]  send_common+0x19f/0x1b0\n[  151.777342]  ? remove_from_waiters+0x60/0x60\n[  151.778017]  ? lock_downgrade+0x410/0x410\n[  151.778648]  ? __this_cpu_preempt_check+0x13/0x20\n[  151.779421]  ? rcu_lockdep_current_cpu_online+0x88/0xc0\n[  151.780292]  _convert_lock+0x46/0x150\n[  151.780893]  convert_lock+0x7b/0xc0\n[  151.781459]  dlm_lock+0x3ac/0x580\n[  151.781993]  ? 0xffffffffc0540000\n[  151.782522]  ? torture_stop+0x120/0x120 [dlm_locktorture]\n[  151.783379]  ? dlm_scan_rsbs+0xa70/0xa70\n[  151.784003]  ? preempt_count_sub+0xd6/0x130\n[  151.784661]  ? is_module_address+0x47/0x70\n[  151.785309]  ? torture_stop+0x120/0x120 [dlm_locktorture]\n[  151.786166]  ? 0xffffffffc0540000\n[  151.786693]  ? lockdep_init_map_type+0xc3/0x360\n[  151.787414]  ? 0xffffffffc0540000\n[  151.787947]  torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture]\n[  151.789004]  ? torture_stop+0x120/0x120 [dlm_locktorture]\n[  151.789858]  ? 0xffffffffc0540000\n[  151.790392]  ? lock_torture_cleanup+0x20/0x20 [dlm_locktorture]\n[  151.791347]  ? delay_tsc+0x94/0xc0\n[  151.791898]  torture_ex_iter+0xc3/0xea [dlm_locktorture]\n[  151.792735]  ? torture_start+0x30/0x30 [dlm_locktorture]\n[  151.793606]  lock_torture+0x177/0x270 [dlm_locktorture]\n[  151.794448]  ? torture_dlm_lock_sync.isra.3+0x150/0x150 [dlm_locktorture]\n[  151.795539]  ? lock_torture_stats+0x80/0x80 [dlm_locktorture]\n[  151.796476]  ? do_raw_spin_lock+0x11e/0x1e0\n[  151.797152]  ? mark_held_locks+0x34/0xb0\n[  151.797784]  ? _raw_spin_unlock_irqrestore+0x30/0x70\n[  151.798581]  ? __kthread_parkme+0x79/0x110\n[  151.799246]  ? trace_preempt_on+0x2a/0xf0\n[  151.799902]  ? __kthread_parkme+0x79/0x110\n[  151.800579]  ? preempt_count_sub+0xd6/0x130\n[  151.801271]  ? __kasan_check_read+0x11/0x20\n[  151.801963]  ? __kthread_parkme+0xec/0x110\n[  151.802630]  ? lock_torture_stats+0x80/0x80 [dlm_locktorture]\n[  151.803569]  kthread+0x192/0x1d0\n[  151.804104]  ? kthread_complete_and_exit+0x30/0x30\n[  151.804881]  ret_from_fork+0x1f/0x30\n[  151.805480]  \u003c/TASK\u003e\n\n[  151.806111] Allocated by task 1347:\n[  151.806681]  kasan_save_stack+0x26/0x50\n[  151.807308]  kasan_set_track+0x25/0x30\n[  151.807920]  kasan_save_alloc_info+0x1e/0x30\n[  151.808609]  __kasan_slab_alloc+0x63/0x80\n[  151.809263]  kmem_cache_alloc+0x1ad/0x830\n[  151.809916]  dlm_allocate_mhandle+0x17/0x20\n[  151.810590]  dlm_midcomms_get_mhandle+0x96/0x260\n[  151.811344]  _create_message+0x95/0x180\n[  151.811994]  create_message.isra.29.constprop.64+0x57/0xc0\n[  151.812880]  send_common+0x129/0x1b0\n[  151.813467]  _convert_lock+0x46/0x150\n[  151.814074]  convert_lock+0x7b/0xc0\n[  151.814648]  dlm_lock+0x3ac/0x580\n[  151.815199]  torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture]\n[  151.816258]  torture_ex_iter+0xc3/0xea [dlm_locktorture]\n[  151.817129]  lock_t\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-07T15:19:32.960Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3b0e9ac3c2447008db942d51f593841d8329e99"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2de9f9b686c71b4fa3663ae374f5f643c46a446"
        },
        {
          "url": "https://git.kernel.org/stable/c/724b6bab0d75f1dc01fdfbf7fe8d4217a5cb90ba"
        }
      ],
      "title": "fs: dlm: fix use after free in midcomms commit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53629",
    "datePublished": "2025-10-07T15:19:32.960Z",
    "dateReserved": "2025-10-07T15:16:59.656Z",
    "dateUpdated": "2025-10-07T15:19:32.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53629\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-07T16:15:45.933\",\"lastModified\":\"2025-10-08T19:38:32.610\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs: dlm: fix use after free in midcomms commit\\n\\nWhile working on processing dlm message in softirq context I experienced\\nthe following KASAN use-after-free warning:\\n\\n[  151.760477] ==================================================================\\n[  151.761803] BUG: KASAN: use-after-free in dlm_midcomms_commit_mhandle+0x19d/0x4b0\\n[  151.763414] Read of size 4 at addr ffff88811a980c60 by task lock_torture/1347\\n\\n[  151.765284] CPU: 7 PID: 1347 Comm: lock_torture Not tainted 6.1.0-rc4+ #2828\\n[  151.766778] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+16134+e5908aa2 04/01/2014\\n[  151.768726] Call Trace:\\n[  151.769277]  \u003cTASK\u003e\\n[  151.769748]  dump_stack_lvl+0x5b/0x86\\n[  151.770556]  print_report+0x180/0x4c8\\n[  151.771378]  ? kasan_complete_mode_report_info+0x7c/0x1e0\\n[  151.772241]  ? dlm_midcomms_commit_mhandle+0x19d/0x4b0\\n[  151.773069]  kasan_report+0x93/0x1a0\\n[  151.773668]  ? dlm_midcomms_commit_mhandle+0x19d/0x4b0\\n[  151.774514]  __asan_load4+0x7e/0xa0\\n[  151.775089]  dlm_midcomms_commit_mhandle+0x19d/0x4b0\\n[  151.775890]  ? create_message.isra.29.constprop.64+0x57/0xc0\\n[  151.776770]  send_common+0x19f/0x1b0\\n[  151.777342]  ? remove_from_waiters+0x60/0x60\\n[  151.778017]  ? lock_downgrade+0x410/0x410\\n[  151.778648]  ? __this_cpu_preempt_check+0x13/0x20\\n[  151.779421]  ? rcu_lockdep_current_cpu_online+0x88/0xc0\\n[  151.780292]  _convert_lock+0x46/0x150\\n[  151.780893]  convert_lock+0x7b/0xc0\\n[  151.781459]  dlm_lock+0x3ac/0x580\\n[  151.781993]  ? 0xffffffffc0540000\\n[  151.782522]  ? torture_stop+0x120/0x120 [dlm_locktorture]\\n[  151.783379]  ? dlm_scan_rsbs+0xa70/0xa70\\n[  151.784003]  ? preempt_count_sub+0xd6/0x130\\n[  151.784661]  ? is_module_address+0x47/0x70\\n[  151.785309]  ? torture_stop+0x120/0x120 [dlm_locktorture]\\n[  151.786166]  ? 0xffffffffc0540000\\n[  151.786693]  ? lockdep_init_map_type+0xc3/0x360\\n[  151.787414]  ? 0xffffffffc0540000\\n[  151.787947]  torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture]\\n[  151.789004]  ? torture_stop+0x120/0x120 [dlm_locktorture]\\n[  151.789858]  ? 0xffffffffc0540000\\n[  151.790392]  ? lock_torture_cleanup+0x20/0x20 [dlm_locktorture]\\n[  151.791347]  ? delay_tsc+0x94/0xc0\\n[  151.791898]  torture_ex_iter+0xc3/0xea [dlm_locktorture]\\n[  151.792735]  ? torture_start+0x30/0x30 [dlm_locktorture]\\n[  151.793606]  lock_torture+0x177/0x270 [dlm_locktorture]\\n[  151.794448]  ? torture_dlm_lock_sync.isra.3+0x150/0x150 [dlm_locktorture]\\n[  151.795539]  ? lock_torture_stats+0x80/0x80 [dlm_locktorture]\\n[  151.796476]  ? do_raw_spin_lock+0x11e/0x1e0\\n[  151.797152]  ? mark_held_locks+0x34/0xb0\\n[  151.797784]  ? _raw_spin_unlock_irqrestore+0x30/0x70\\n[  151.798581]  ? __kthread_parkme+0x79/0x110\\n[  151.799246]  ? trace_preempt_on+0x2a/0xf0\\n[  151.799902]  ? __kthread_parkme+0x79/0x110\\n[  151.800579]  ? preempt_count_sub+0xd6/0x130\\n[  151.801271]  ? __kasan_check_read+0x11/0x20\\n[  151.801963]  ? __kthread_parkme+0xec/0x110\\n[  151.802630]  ? lock_torture_stats+0x80/0x80 [dlm_locktorture]\\n[  151.803569]  kthread+0x192/0x1d0\\n[  151.804104]  ? kthread_complete_and_exit+0x30/0x30\\n[  151.804881]  ret_from_fork+0x1f/0x30\\n[  151.805480]  \u003c/TASK\u003e\\n\\n[  151.806111] Allocated by task 1347:\\n[  151.806681]  kasan_save_stack+0x26/0x50\\n[  151.807308]  kasan_set_track+0x25/0x30\\n[  151.807920]  kasan_save_alloc_info+0x1e/0x30\\n[  151.808609]  __kasan_slab_alloc+0x63/0x80\\n[  151.809263]  kmem_cache_alloc+0x1ad/0x830\\n[  151.809916]  dlm_allocate_mhandle+0x17/0x20\\n[  151.810590]  dlm_midcomms_get_mhandle+0x96/0x260\\n[  151.811344]  _create_message+0x95/0x180\\n[  151.811994]  create_message.isra.29.constprop.64+0x57/0xc0\\n[  151.812880]  send_common+0x129/0x1b0\\n[  151.813467]  _convert_lock+0x46/0x150\\n[  151.814074]  convert_lock+0x7b/0xc0\\n[  151.814648]  dlm_lock+0x3ac/0x580\\n[  151.815199]  torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture]\\n[  151.816258]  torture_ex_iter+0xc3/0xea [dlm_locktorture]\\n[  151.817129]  lock_t\\n---truncated---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/724b6bab0d75f1dc01fdfbf7fe8d4217a5cb90ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a2de9f9b686c71b4fa3663ae374f5f643c46a446\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a3b0e9ac3c2447008db942d51f593841d8329e99\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.