md: don't dereference mddev after export_rdev()

{
  "id": "1326eb82821ee6f6e7a0c58f864418c01935c05fede24491a03a6d53a5c205ed",
  "url": "https://osv.dev/vulnerability/CVE-2023-53665",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "md: don't dereference mddev after export_rdev()",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: md: don't dereference mddev after export_rdev() Except for initial reference, mddev->kobject is referenced by rdev->kobject, and if the last rdev is freed, there is no guarantee that mddev is still valid. Hence mddev should not be used anymore after export_rdev(). This problem can be triggered by following test for mdadm at very low rate: New file: mdadm/tests/23rdev-lifetime devname=${dev0##*/} devt=`cat /sys/block/$devname/dev` pid=\"\" runtime=2 clean_up_test() { pill -9 $pid echo clear > /sys/block/md0/md/array_state } trap 'clean_up_test' EXIT add_by_sysfs() { while true; do echo $devt > /sys/block/md0/md/new_dev done } remove_by_sysfs(){ while true; do echo remove > /sys/block/md0/md/dev-${devname}/state done } echo md0 > /sys/module/md_mod/parameters/new_array || die \"create md0 failed\" add_by_sysfs & pid=\"$pid $!\" remove_by_sysfs & pid=\"$pid $!\" sleep $runtime exit 0 Test cmd: ./test --save-logs --logdir=/tmp/ --keep-going --dev=loop --tests=23rdev-lifetime Test result: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bcb: 0000 [#4] PREEMPT SMP CPU: 0 PID: 1292 Comm: test Tainted: G D W 6.5.0-rc2-00121-g01e55c376936 #562 RIP: 0010:md_wakeup_thread+0x9e/0x320 [md_mod] Call Trace: mddev_unlock+0x1b6/0x310 [md_mod] rdev_attr_store+0xec/0x190 [md_mod] sysfs_kf_write+0x52/0x70 kernfs_fop_write_iter+0x19a/0x2a0 vfs_write+0x3b5/0x770 ksys_write+0x74/0x150 __x64_sys_write+0x22/0x30 do",
    "evidence": "osv:CVE-2023-53665",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.5.5",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2023-53665",
      "aliases": [
        "CVE-2023-53665"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "3ce94ce5d05ae89190a23f6187f64d8f4b2d3782"
                },
                {
                  "fixed": "ad430ad0669d2757377373390d68e1454fc7a344"
                },
                {
                  "fixed": "7deac114be5fb25a4e865212ed0feaf5f85f2a28"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53665.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.5.0"
                },
                {
                  "fixed": "6.5.5"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53665.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:28.662185640Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/7deac114be5fb25a4e865212ed0feaf5f85f2a28",
        "https://git.kernel.org/stable/c/ad430ad0669d2757377373390d68e1454fc7a344",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53665.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-53665",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53665.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-53665",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 495037,
  "published_at": "2025-10-07T15:21:23.808+00:00"
}