LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53531: null_blk: fix poll request timeout handling

In the Linux kernel, the following vulnerability has been resolved: null_blk: fix poll request timeout handling When doing io_uring benchmark on /dev/nullb0, it's easy to crash the kernel if poll requests timeout triggered, as reported by David. [1] BUG: kernel NULL pointer dereference, address: 0000000000000008 Workqueue: kblockd blk_mq_timeout_work RIP: 0010:null_timeout_rq+0x4e/0x91 Call Trace: ? null_timeout_rq+0x4e/0x91 blk_mq_handle_expired+0x31/0x4b bt_iter+0x68/0x84 ? bt_tags_iter+0x81/0x81 __sbitmap_for_each_set.constprop.0+0xb0/0xf2 ? __blk_mq_complete_request_remote+0xf/0xf bt_for_each+0x46/0x64 ? __blk_mq_complete_request_remote+0xf/0xf ? percpu_ref_get_many+0xc/0x2a blk_mq_queue_tag_busy_iter+0x14d/0x18e blk_mq_timeout_work+0x95/0x127 process_one_work+0x185/0x263 worker_thread+0x1b5/0x227 This is indeed a race problem between null_timeout_rq() and null_poll(). null_poll() null_timeout_rq() spin_lock(&nq->poll_lock) list_splice_init(&nq->poll_list, &list) spin_unlock(&nq->poll_lock) while (!list_empty(&list)) req = list_first_entry() list_del_init() ... blk_mq_add_to_batch() // req->rq_next = NULL spin_lock(&nq->poll_lock) // rq->queuelist->next == NULL list_del_init(&rq->queuelist) spin_unlock(&nq->poll_lock) Fix these problems by setting requests state to MQ_RQ_COMPLETE under nq->poll_lock protection, in which null_timeout_rq() can safely detect this race and early return. Note this patch just fix the kernel panic when request timeout happen. [1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-53531 is a Linux kernel availability bug in the null_blk test block device. Under specific io_uring poll timeout conditions, a race can crash the kernel. The available sources do not show active exploitation or broad remote exposure.

Executive priority

Treat this as a targeted availability risk, not a confirmed internet-scale emergency. Prioritize kernel maintenance for systems using null_blk or storage benchmarking, and rely on vendor kernel updates for remediation.

Technical view

The flaw is a race between null_poll() and null_timeout_rq() for null_blk poll requests. A request can be removed while timeout handling still processes its queue list, causing a NULL pointer dereference in kernel workqueue timeout handling. The fix marks requests complete under poll_lock so timeout handling can return safely.

Likely exposure

Exposure is most likely on Linux systems using the null_blk block device, such as storage testing, benchmarking, or development environments. Production exposure depends on whether null_blk is enabled and reachable by local workloads.

Exploitation context

The source describes kernel crashes during io_uring benchmarking on /dev/nullb0 when poll request timeouts occur. CISA KEV is false in the provided bundle, and no cited source claims active exploitation.

Researcher notes

The bundle provides a clear root cause and fix direction but lacks CVSS, CWE, distro package mapping, and exploitability analysis. Affected-version data appears kernel-specific and should be reconciled with vendor advisories before fleet decisions.

Mitigation direction

  • Apply a kernel update that includes the referenced stable null_blk fixes.
  • Check Linux distribution advisories for backported fixes and affected package versions.
  • Disable or avoid null_blk test-device usage where it is not operationally required.
  • Prioritize systems running storage tests or io_uring benchmarks against /dev/nullb0.

Validation and detection

  • Inventory Linux hosts for affected kernel versions and null_blk usage.
  • Confirm installed kernels include one of the referenced stable commits or vendor backports.
  • Review kernel crash logs for null_timeout_rq and blk_mq_timeout_work traces.
  • Check whether /dev/nullb0 exists on systems handling untrusted local workloads.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53531 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0a593fbbc245a85940ed34caa3aa1e4cb060c54b, 0a593fbbc245a85940ed34caa3aa1e4cb060c54b, 0a593fbbc245a85940ed34caa3aa1e4cb060c54bunaffected
LinuxLinux5.16, 0, 6.1.54, 6.5.4, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.