CVE-2023-53722

md: raid1: fix potential OOB in raid1_remove_disk()

published October 22, 2025

CVSS
—
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

md: raid1: fix potential OOB in raid1_remove_disk()

If rddev->raid_disk is greater than mddev->raid_disks, there will be

an out-of-bounds in raid1_remove_disk(). We have already found

similar reports as follows:

1) commit d17f744e883b ("md-raid10: fix KASAN warning")

2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")

Fix this bug by checking whether the "number" variable is

valid.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.6th percentile
Published
2025-10-22T13:23Z
EPSS history
Timeline
  • 22 OCT 13:23Z
    md: raid1: fix potential OOB in raid1_remove_disk()
    cvelistv5