Null Pointer Dereference in Linux Kernel Affecting Block Device I/O

CVE-2023-53366

What is CVE-2023-53366?

A vulnerability in the Linux Kernel can lead to a crash during polled I/O operations caused by a NULL pointer reference to the block device. This issue arises when multiple tasks attempt to share a poll queue, leading to potential preemption issues. Specifically, if one task completes an I/O operation and stores the bio in the cache, that bio may be reallocated before the previous task finishes polling on it. Developers must ensure additional safeguards when checking for NULL values in the bio structure to avoid crashes.

References