Critical 9.8Published May 2, 2025

CVE-2023-53116nvmet: avoid potential UAF in nvmet_req_complete()

Updated under an hour ago (Oct 26, 2026, 11:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmet_req_complete() An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpu_ref_put() is called in nvmet_req_complete(). Avoid such problem by using a local variable to save the sq pointer before calling __nvmet_req_complete(), thus avoiding dereferencing the req pointer after that function call.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a07b4970f464f13640e28e16dad6cfa33647cc99 before e5d99b29012bbf0e86929403209723b2806500c1; from a07b4970f464f13640e28e16dad6cfa33647cc99 before fafcb4b26393870c45462f9af6a48e581dbbcf7e; from a07b4970f464f13640e28e16dad6cfa33647cc99 before 04c394208831d5e0d5cfee46722eb0f033cd4083; from a07b4970f464f13640e28e16dad6cfa33647cc99 before a6317235da8aa7cb97529ebc8121cc2a4c4c437a; from a07b4970f464f13640e28e16dad6cfa33647cc99 before f1d5888a5efe345b63c430b256e95acb0a475642; from a07b4970f464f13640e28e16dad6cfa33647cc99 before bcd535f07c58342302a2cd2bdd8894fe0872c8a9; from a07b4970f464f13640e28e16dad6cfa33647cc99 before 8ed9813871038b25a934b21ab76b5b7dbf44fc3a; from a07b4970f464f13640e28e16dad6cfa33647cc99 before 6173a77b7e9d3e202bdb9897b23f2a8afe7bf286	CNA record
linux linux_kernel linux:linux_kernel	from 4.8 before 4.14.311; from 4.15 before 4.19.279; from 4.20 before 5.4.238; from 5.5 before 5.10.176; from 5.11 before 5.15.104; from 5.16 before 6.1.21; from 6.2 before 6.2.8; 6.3; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/e5d99b29012bbf0e86929403209723b2806500c1	patch
https://git.kernel.org/stable/c/fafcb4b26393870c45462f9af6a48e581dbbcf7e	patch
https://git.kernel.org/stable/c/04c394208831d5e0d5cfee46722eb0f033cd4083	patch
https://git.kernel.org/stable/c/a6317235da8aa7cb97529ebc8121cc2a4c4c437a	patch
https://git.kernel.org/stable/c/f1d5888a5efe345b63c430b256e95acb0a475642	patch
https://git.kernel.org/stable/c/bcd535f07c58342302a2cd2bdd8894fe0872c8a9	patch
https://git.kernel.org/stable/c/8ed9813871038b25a934b21ab76b5b7dbf44fc3a	patch
https://git.kernel.org/stable/c/6173a77b7e9d3e202bdb9897b23f2a8afe7bf286	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.