{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2023-53867",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2023-53867"
  ],
  "published": "2025-12-24T10:57:20Z",
  "summary": "ceph: fix potential use-after-free bug when trimming caps",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix potential use-after-free bug when trimming caps\n\nWhen trimming the caps and just after the 'session->s_cap_lock' is\nreleased in ceph_iterate_session_caps() the cap maybe removed by\nanother thread, and when using the stale cap memory in the callbacks\nit will trigger use-after-free crash.\n\nWe need to check the existence of the cap just after the 'ci->i_ceph_lock'\nbeing acquired. And do nothing if it's already removed.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.21-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v6",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7l",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v8",
            "binary_version": "1:6.1.21-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.21-1+rpt1": {
            "linux_commit": "0afb5e98488aed7017b9bf321b575d0177feb7ed",
            "upstream_version": "6.1.21",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.28"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53867"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2b2515b8095cf2149bef44383a99d5b5677f1831"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/448875a73e16ba7d81dec9274ce9d33a12d092fb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ae6e935618d99cdba11eab4714092e7e5f13cf7e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/aaf67de78807c59c35bafb5003d4fb457c764800"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:24:39Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 9.8,
      "cvss_v3_severity": "Critical",
      "scenario": "AV:N - Every caller of the vulnerable `ceph_iterate_session_caps()` is driven by a message received from the remote Ceph MDS over TCP \u2014 `CEPH_SESSION_RECALL_STATE` (trim), `CLOSE`/`REJECT` (remove_session_caps), `STALE` (renewcaps) and MDS reconnect \u2014 processed in `handle_session()` on the messenger workqueue. A malicious, compromised, or on-path-spoofed MDS reaches the code purely with network traffic.\nAC:L - The attacker drives both sides of the race: `RECALL_STATE`/session-close/reconnect storms start the cap iteration while concurrent cap-revoke/export/session messages and the callback's own `d_prune_aliases()`/inode-eviction path remove caps. The window spans sleeping operations (`d_find_primary()`, `ceph_mdsc_build_path()`, dentry pruning) and can be retried indefinitely, so it is reliably hit.\nPR:N - No credentials or privileges on the victim client are required \u2014 the malicious MDS peer needs no local authority, and the code runs unauthenticated with respect to the client's privilege model. Locally, mere unprivileged access to a mounted CephFS is enough to generate the concurrent cap churn.\nUI:N - Exploitation needs no victim action beyond an already-mounted CephFS, which is the normal operating state of an affected system; the MDS drives the whole sequence on its own.\nS:U - The stale `struct ceph_cap` corruption and the resulting oops are confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The use-after-free gives a read primitive over freed/recycled `ceph_cap` slab memory, and `reconnect_caps_cb()` encodes those stale fields (`cap->cap_id`, `cap->issued`) directly into the reconnect message transmitted to the MDS, exfiltrating freed-object contents to the attacker.\nI:H - The callbacks write into the stale object \u2014 `cap->seq/issue_seq/mseq/cap_gen = 0` in `reconnect_caps_cb()` and `cap->issued = cap->implemented = CEPH_CAP_PIN` in `wake_up_session_cb()` \u2014 corrupting a recycled `ceph_cap` (and thus another inode's capability/coherency state), a UAF write primitive usable for heap grooming toward control-flow hijack.\nA:H - The reported real-world outcome is a kernel NULL-pointer dereference oops in `__ceph_remove_cap()` from the trim-caps path (Ceph tracker #43272), and any use-after-free of the cap object crashes the client; the MDS can trigger it repeatedly."
    }
  }
}