Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash affected systems when they use NFSv4.2 READ_PLUS handling. It is an availability risk, not a confidentiality or integrity issue in the provided scoring. Exploitation requires local privileges, so urgency is highest for Linux hosts where local users or workloads can trigger NFS reads.
Executive priority
Treat this as a moderate-priority reliability issue. Patch affected Linux systems during the next practical maintenance window, sooner for shared servers, multi-user systems, or environments where local workloads can trigger NFS client reads.
Technical view
The flaw is a double-free and scratch-buffer state bug in Linux NFSv4.2 READ_PLUS reply decoding. Reused nfs_pgio_header objects could leave a NULL scratch pointer with a non-zero length, causing a kernel oops during READ_PLUS hole segment decoding. The fix moves scratch allocation and freeing into pageio read handling.
Likely exposure
Exposure is limited to affected Linux kernel versions and systems using NFSv4.2 client functionality. The source lists Linux kernel versions including 6.4, 6.4.16, 6.5.3, and 6.6 as affected, but distribution-specific package status is not provided.
Exploitation context
The CVSS vector is local, low complexity, low privileges, and no user interaction, with high availability impact. The source bundle does not report active exploitation, and KEV status is false. No remote unauthenticated exploitation is supported by the provided evidence.
Researcher notes
Evidence supports an NFSv4.2 client-side kernel availability flaw tied to READ_PLUS hole segment decoding and scratch-buffer lifecycle handling. The supplied data does not define distro package boundaries, exploit availability, or operational workarounds, so validation should focus on kernel version, NFSv4.2 use, and vendor fixed builds.
Mitigation direction
- Apply vendor kernel updates containing the referenced upstream stable fixes.
- Prioritize Linux systems using NFSv4.2 mounts or NFS-heavy workloads.
- Check distribution advisories for exact fixed package versions.
- If patching is delayed, consult vendor guidance for temporary NFS client risk reduction.
Validation and detection
- Inventory Linux kernel versions across servers, workstations, and appliances.
- Identify hosts using NFSv4.2 client mounts or related workloads.
- Review kernel logs for oops events during NFS READ_PLUS activity.
- Compare installed kernel packages against vendor advisories and upstream stable commits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-415: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-53360 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/adac9f0ddd2b291c7ce41f549fdb27a13616cff5CVE reference, Linux
- https://git.kernel.org/stable/c/a2f4cb206bd94b3f4a7bb05fcdce9525283b5681CVE reference, Linux
- https://git.kernel.org/stable/c/ae5d5672f1db711e91db6f52df5cb16ecd8f5692CVE reference, Linux
- https://git.kernel.org/stable/c/303a78052091c81e9003915c521fdca1c7e117afCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Double Free
Double Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.