GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53083 (GCVE-0-2023-53083)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:55 – Updated: 2026-08-05 09:12
VLAI
Title
nfsd: don't replace page in rq_pages if it's a continuation of last page
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rq_pages if it's a continuation of last page The splice read calls nfsd_splice_actor to put the pages containing file data into the svc_rqst->rq_pages array. It's possible however to get a splice result that only has a partial page at the end, if (e.g.) the filesystem hands back a short read that doesn't cover the whole page. nfsd_splice_actor will plop the partial page into its rq_pages array and return. Then later, when nfsd_splice_actor is called again, the remainder of the page may end up being filled out. At this point, nfsd_splice_actor will put the page into the array _again_ corrupting the reply. If this is done enough times, rq_next_page will overrun the array and corrupt the trailing fields -- the rq_respages and rq_next_page pointers themselves. If we've already added the page to the array in the last pass, don't add it to the array a second time when dealing with a splice continuation. This was originally handled properly in nfsd_splice_actor, but commit 91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") removed the check for it.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bf1cbe2f3650b4f4a8add6af933c6d7f6af1f361 , < 8235cd619db6e67f1d7d26c55f1f3e4e575c947d (git)
Affected: 56bc7e3821e847a6cc8027ddaba32e9a440225a5 , < 12eca509234acb6b666802edf77408bb70d7bfca (git)
Affected: 91e23b1c39820bfed642119ff6b6ef9f43cf09ce , < 51ddb84baff6f09ad62b5999ece3ec172e4e3568 (git)
Affected: 91e23b1c39820bfed642119ff6b6ef9f43cf09ce , < 0101067f376eb7b9afd00279270f25d5111a091d (git)
Affected: 91e23b1c39820bfed642119ff6b6ef9f43cf09ce , < 27c934dd8832dd40fd34776f916dc201e18b319b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.22 , ≤ 6.1.* (semver)
Unaffected: 6.2.9 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8235cd619db6e67f1d7d26c55f1f3e4e575c947d",
              "status": "affected",
              "version": "bf1cbe2f3650b4f4a8add6af933c6d7f6af1f361",
              "versionType": "git"
            },
            {
              "lessThan": "12eca509234acb6b666802edf77408bb70d7bfca",
              "status": "affected",
              "version": "56bc7e3821e847a6cc8027ddaba32e9a440225a5",
              "versionType": "git"
            },
            {
              "lessThan": "51ddb84baff6f09ad62b5999ece3ec172e4e3568",
              "status": "affected",
              "version": "91e23b1c39820bfed642119ff6b6ef9f43cf09ce",
              "versionType": "git"
            },
            {
              "lessThan": "0101067f376eb7b9afd00279270f25d5111a091d",
              "status": "affected",
              "version": "91e23b1c39820bfed642119ff6b6ef9f43cf09ce",
              "versionType": "git"
            },
            {
              "lessThan": "27c934dd8832dd40fd34776f916dc201e18b319b",
              "status": "affected",
              "version": "91e23b1c39820bfed642119ff6b6ef9f43cf09ce",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.22",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.9",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: don\u0027t replace page in rq_pages if it\u0027s a continuation of last page\n\nThe splice read calls nfsd_splice_actor to put the pages containing file\ndata into the svc_rqst-\u003erq_pages array. It\u0027s possible however to get a\nsplice result that only has a partial page at the end, if (e.g.) the\nfilesystem hands back a short read that doesn\u0027t cover the whole page.\n\nnfsd_splice_actor will plop the partial page into its rq_pages array and\nreturn. Then later, when nfsd_splice_actor is called again, the\nremainder of the page may end up being filled out. At this point,\nnfsd_splice_actor will put the page into the array _again_ corrupting\nthe reply. If this is done enough times, rq_next_page will overrun the\narray and corrupt the trailing fields -- the rq_respages and\nrq_next_page pointers themselves.\n\nIf we\u0027ve already added the page to the array in the last pass, don\u0027t add\nit to the array a second time when dealing with a splice continuation.\nThis was originally handled properly in nfsd_splice_actor, but commit\n91e23b1c3982 (\"NFSD: Clean up nfsd_splice_actor()\") removed the check\nfor it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in nfsd_splice_actor on the NFSv2/v3/v4 READ splice path, reached by sending NFS READ RPCs to the in-kernel NFS server over TCP/UDP port 2049 from a remote client; no local access is required.\nAC:L - A remote client fully controls READ offsets/lengths and can retry at will; real-world Android/Kodi clients reliably triggered the partial-page splice continuation that causes the duplicate insert and array overrun, with no race outside attacker influence.\nPR:N - Under typical AUTH_SYS/AUTH_UNIX exports the client self-asserts uid/gid with no cryptographic secret; any host permitted by the export list can LOOKUP/OPEN and issue READ with no server-verified privileges.\nUI:N - The attacking NFS client issues the READ requests itself; no action by any administrator or other user on the server is required.\nS:U - The overrun corrupts fields inside the server\u0027s svc_rqst within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The OOB write corrupts rq_respages/rq_next_page and was observed to drive page/folio refcount underflow, creating a UAF-class primitive over page-cache objects that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Unbounded svc_rqst_replace_page writes of page pointers past rq_pages overwrite adjacent kernel pointers and skew page refcounts, yielding an out-of-bounds write / UAF write primitive exploitable for control-flow hijack.\nA:H - Production reports show repeatable nfsd kthread GPFs in release_pages and VM_BUG_ON folio refcount underflow during splice READ cleanup, crashing or freezing the NFS server and requiring reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:39.153Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8235cd619db6e67f1d7d26c55f1f3e4e575c947d"
        },
        {
          "url": "https://git.kernel.org/stable/c/12eca509234acb6b666802edf77408bb70d7bfca"
        },
        {
          "url": "https://git.kernel.org/stable/c/51ddb84baff6f09ad62b5999ece3ec172e4e3568"
        },
        {
          "url": "https://git.kernel.org/stable/c/0101067f376eb7b9afd00279270f25d5111a091d"
        },
        {
          "url": "https://git.kernel.org/stable/c/27c934dd8832dd40fd34776f916dc201e18b319b"
        }
      ],
      "title": "nfsd: don\u0027t replace page in rq_pages if it\u0027s a continuation of last page",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53083",
    "datePublished": "2025-05-02T15:55:31.699Z",
    "dateReserved": "2025-05-02T15:51:43.550Z",
    "dateUpdated": "2026-08-05T09:12:39.153Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53083",
      "date": "2026-09-17",
      "epss": "0.00481",
      "percentile": "0.40424"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53083\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-02T16:15:27.310\",\"lastModified\":\"2026-08-04T10:18:54.063\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: don\u0027t replace page in rq_pages if it\u0027s a continuation of last page\\n\\nThe splice read calls nfsd_splice_actor to put the pages containing file\\ndata into the svc_rqst-\u003erq_pages array. It\u0027s possible however to get a\\nsplice result that only has a partial page at the end, if (e.g.) the\\nfilesystem hands back a short read that doesn\u0027t cover the whole page.\\n\\nnfsd_splice_actor will plop the partial page into its rq_pages array and\\nreturn. Then later, when nfsd_splice_actor is called again, the\\nremainder of the page may end up being filled out. At this point,\\nnfsd_splice_actor will put the page into the array _again_ corrupting\\nthe reply. If this is done enough times, rq_next_page will overrun the\\narray and corrupt the trailing fields -- the rq_respages and\\nrq_next_page pointers themselves.\\n\\nIf we\u0027ve already added the page to the array in the last pass, don\u0027t add\\nit to the array a second time when dealing with a splice continuation.\\nThis was originally handled properly in nfsd_splice_actor, but commit\\n91e23b1c3982 (\\\"NFSD: Clean up nfsd_splice_actor()\\\") removed the check\\nfor it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: no reemplace la p\u00e1gina en rq_pages si es una continuaci\u00f3n de la \u00faltima p\u00e1gina la lectura de empalme llama a nfsd_splice_actor para poner las p\u00e1ginas que contienen datos de archivo en la matriz svc_rqst-\u0026gt;rq_pages. Sin embargo, es posible obtener un resultado de empalme que solo tenga una p\u00e1gina parcial al final, si (p. ej.) el sistema de archivos devuelve una lectura corta que no cubre toda la p\u00e1gina. nfsd_splice_actor colocar\u00e1 la p\u00e1gina parcial en su matriz rq_pages y retornar\u00e1. Luego, m\u00e1s tarde, cuando se vuelva a llamar a nfsd_splice_actor, el resto de la p\u00e1gina puede terminar llen\u00e1ndose. En este punto, nfsd_splice_actor colocar\u00e1 la p\u00e1gina en array _again_ corrompiendo la respuesta. Si esto se repite varias veces, rq_next_page saturar\u00e1 el array y corromper\u00e1 los campos finales: los punteros rq_respages y rq_next_page. Si ya a\u00f1adimos la p\u00e1gina al array en la \u00faltima pasada, no la a\u00f1adamos una segunda vez al tratar con una continuaci\u00f3n de empalme. Esto se gestionaba correctamente en nfsd_splice_actor, pero el commit 91e23b1c3982 (\\\"NFSD: Limpiar nfsd_splice_actor()\\\") elimin\u00f3 la comprobaci\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/vfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bf1cbe2f3650b4f4a8add6af933c6d7f6af1f361\",\"lessThan\":\"8235cd619db6e67f1d7d26c55f1f3e4e575c947d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"56bc7e3821e847a6cc8027ddaba32e9a440225a5\",\"lessThan\":\"12eca509234acb6b666802edf77408bb70d7bfca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"91e23b1c39820bfed642119ff6b6ef9f43cf09ce\",\"lessThan\":\"51ddb84baff6f09ad62b5999ece3ec172e4e3568\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"91e23b1c39820bfed642119ff6b6ef9f43cf09ce\",\"lessThan\":\"0101067f376eb7b9afd00279270f25d5111a091d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"91e23b1c39820bfed642119ff6b6ef9f43cf09ce\",\"lessThan\":\"27c934dd8832dd40fd34776f916dc201e18b319b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/vfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.22\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.9\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.1.22\",\"matchCriteriaId\":\"3ABED26E-DCA7-48C4-B7FC-6722DF89A2D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.2.9\",\"matchCriteriaId\":\"914F22DD-1E6F-4B0A-A14D-3A9F068F6761\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8E3B0E8-FA27-4305-87BB-AF6C25B160CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A47F0FC3-CE52-4BA1-BA51-22F783938431\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3583026A-27EC-4A4C-850A-83F2AF970673\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0101067f376eb7b9afd00279270f25d5111a091d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/12eca509234acb6b666802edf77408bb70d7bfca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/27c934dd8832dd40fd34776f916dc201e18b319b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51ddb84baff6f09ad62b5999ece3ec172e4e3568\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8235cd619db6e67f1d7d26c55f1f3e4e575c947d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:22:00+00:00",
      "cve": "CVE-2023-53083",
      "id": "CVE-2023-53083",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "124",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: don\u0027t replace page in rq_pages if it\u0027s a continuation of last page",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53083.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.