LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53511: io_uring: fix fget leak when fs don't support nowait buffered read

In the Linux kernel, the following vulnerability has been resolved: io_uring: fix fget leak when fs don't support nowait buffered read Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1] Do the following steps can reproduce this BUG: mount -t ocfs2 /dev/vdc /mnt/ocfs2 cp testfile /mnt/ocfs2/ ./link-cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1 umount /mnt/ocfs2 Then umount will fail, and it outputs: umount: /mnt/ocfs2: target is busy. While tracing umount, it blames mnt_get_count() not return as expected. Do a deep investigation for fget()/fput() on related code flow, I've finally found that fget() leaks since ocfs2 doesn't support nowait buffered read. io_issue_sqe |-io_assign_file // do fget() first |-io_read |-io_iter_do_read |-ocfs2_file_read_iter // return -EOPNOTSUPP |-kiocb_done |-io_rw_done |-__io_complete_rw_common // set REQ_F_REISSUE |-io_resubmit_prep |-io_req_prep_async // override req->file, leak happens This was introduced by commit a196c78b5443 in v5.18. Fix it by don't re-assign req->file if it has already been assigned. [1] https://lore.kernel.org/ocfs2-devel/ab580a75-91c8-d68a-3455-40361be1bfa8@linux.alibaba.com/T/#t

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can leak a file reference during an io_uring read path when the filesystem does not support nowait buffered reads. The reported symptom was an OCFS2 filesystem that could not be unmounted because the kernel still considered it busy.

Executive priority

Treat this as a maintenance-priority kernel reliability issue unless local exposure is high. It is not supported as actively exploited in the provided sources, but storage systems using affected kernel paths should be patched promptly to avoid operational disruption.

Technical view

The bug is in io_uring request handling. After fget(), an unsupported nowait buffered read can return EOPNOTSUPP, trigger reissue handling, and overwrite req->file during async preparation, leaking the earlier reference. The fix avoids reassigning req->file once assigned.

Likely exposure

Exposure appears limited to affected Linux kernel versions using io_uring with filesystems that do not support nowait buffered reads. OCFS2 is the cited example. The bundle does not identify affected distribution packages, default configurations, or remote exposure.

Exploitation context

The source bundle does not show CISA KEV listing, active exploitation, weaponization, or a CVSS score. The public description is a bug report and kernel fix context. The demonstrated impact is operational disruption from a leaked reference preventing unmount.

Researcher notes

Evidence supports a kernel reference leak tied to io_uring reissue handling and filesystems returning EOPNOTSUPP for nowait buffered reads. Impact details beyond failed unmount are not provided. No CWE, CVSS, or exploit status is included in the source bundle.

Mitigation direction

  • Upgrade to a kernel containing the referenced stable fixes.
  • Check distribution advisories for CVE-2023-53511 backports.
  • Prioritize systems using io_uring with OCFS2 or similar filesystems.
  • Avoid deploying affected kernels for relevant storage workloads until fixed.

Validation and detection

  • Inventory Linux kernel versions across affected systems.
  • Confirm whether io_uring and OCFS2 are used in production workloads.
  • Check vendor kernel changelogs for the referenced stable commits.
  • Test unmount behavior after applying the fixed kernel.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53511 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa196c78b5443fc61af2c0490213b9d125482cbd1, a196c78b5443fc61af2c0490213b9d125482cbd1, a196c78b5443fc61af2c0490213b9d125482cbd1, cef27a7d36026bd3c86f4fdfb4611ebbe2814af4, 5.17.9unaffected
LinuxLinux5.18, 0, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.