#VU96347 NULL pointer dereference in Linux kernel - CVE-2023-52896
Published: August 21, 2024 / Updated: May 12, 2025
Vulnerability identifier: #VU96347
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-52896
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Linux kernel
Linux kernel
Software vendor:
Linux Foundation
Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the btrfs_qgroup_rescan_worker() and mutex_unlock() functions in fs/btrfs/qgroup.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
External links
- https://git.kernel.org/stable/c/89ac597e3e807b91e2ebd6a7c36fec7b97290233
- https://git.kernel.org/stable/c/3bd43374857103ba3cac751d6d4afa8d83b5d92a
- https://git.kernel.org/stable/c/64287cd456a22373053998c1fccf14b651e9cbbd
- https://git.kernel.org/stable/c/1004fc90f0d79a4b7d9e3d432729914f472f9ad1
- https://git.kernel.org/stable/c/b7adbf9ada3513d2092362c8eac5cddc5b651f5c
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.165
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.90
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.230
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.8
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2