Skip to content
OpenAdvisories
Unscored CVE-2023-53513 EUVD-2025-32743GHSA-jvcg-848p-wjgf

nbd: fix incomplete validation of ioctl arg

Published Oct 1, 2025 · Updated Jun 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.4 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-fips Package: linux-aws-hwe Package: linux-azure Package: linux-azure-4.15 Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.4 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-fips Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-4.15 Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.4 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.4 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-ibm-5.4 Package: linux-intel Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-iot Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lts-xenial Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.4 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi Package: linux-raspi-5.4 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

nbd: fix incomplete validation of ioctl arg

We tested and found an alarm caused by nbd_ioctl arg without verification.
The UBSAN warning calltrace like below:

UBSAN: Undefined behaviour in fs/buffer.c:1709:35
signed integer overflow:
-9223372036854775808 - 1 cannot be represented in type 'long long int'
CPU: 3 PID: 2523 Comm: syz-executor.0 Not tainted 4.19.90 #1
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x0/0x3f0 arch/arm64/kernel/time.c:78
show_stack+0x28/0x38 arch/arm64/kernel/traps.c:158
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x170/0x1dc lib/dump_stack.c:118
ubsan_epilogue+0x18/0xb4 lib/ubsan.c:161
handle_overflow+0x188/0x1dc lib/ubsan.c:192
__ubsan_handle_sub_overflow+0x34/0x44 lib/ubsan.c:206
__block_write_full_page+0x94c/0xa20 fs/buffer.c:1709
block_write_full_page+0x1f0/0x280 fs/buffer.c:2934
blkdev_writepage+0x34/0x40 fs/block_dev.c:607
__writepage+0x68/0xe8 mm/page-writeback.c:2305
write_cache_pages+0x44c/0xc70 mm/page-writeback.c:2240
generic_writepages+0xdc/0x148 mm/page-writeback.c:2329
blkdev_writepages+0x2c/0x38 fs/block_dev.c:2114
do_writepages+0xd4/0x250 mm/page-writeback.c:2344

The reason for triggering this warning is __block_write_full_page()
-> i_size_read(inode) - 1 overflow.
inode->i_size is assigned in __nbd_ioctl() -> nbd_set_size() -> bytesize.
We think it is necessary to limit the size of arg to prevent errors.

Moreover, __nbd_ioctl() -> nbd_add_socket(), arg will be cast to int.
Assuming the value of arg is 0x80000000000000001) (on a 64-bit machine),
it will become 1 after the coercion, which will return unexpected results.

Fix it by adding checks to prevent passing in too large numbers.

Affected products

VendorProductAffectedFixed
Linux Linux 4.1 5.15.113

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.3.7-1 —
Debian 13 linux 6.3.7-1 —
Debian 12 linux 6.1.37-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield 5.15.0-1023.25 —
Ubuntu 24.04 LTS linux-intel +9 No fix yet —
Ubuntu 22.04 LTS linux +1 5.15.0-83.92 —
Ubuntu 22.04 LTS linux-aws 5.15.0-1044.49 —
Ubuntu 22.04 LTS linux-azure 5.15.0-1046.53 —
Ubuntu 22.04 LTS linux-azure-fde 5.15.0-1046.53.1 —
Ubuntu 22.04 LTS linux-gcp 5.15.0-1041.49 —
Ubuntu 22.04 LTS linux-gke +1 5.15.0-1041.46 —
Ubuntu 22.04 LTS linux-gkeop 5.15.0-1027.32 —
Ubuntu 22.04 LTS linux-ibm +1 5.15.0-1037.40 —
Ubuntu 22.04 LTS linux-intel-iotg 5.15.0-1039.45 —
Ubuntu 22.04 LTS linux-nvidia 5.15.0-1032.32 —
Ubuntu 22.04 LTS linux-nvidia-tegra 5.15.0-1017.17 —
Ubuntu 22.04 LTS linux-nvidia-tegra-igx 5.15.0-1004.4 —
Ubuntu 22.04 LTS linux-oracle 5.15.0-1042.48 —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 22.04 LTS linux-xilinx-zynqmp 5.15.0-1025.29 —
Ubuntu 20.04 LTS linux-aws-5.15 5.15.0-1044.49~20.04.1 —
Ubuntu 20.04 LTS linux-azure-5.15 5.15.0-1046.53~20.04.1 —
Ubuntu 20.04 LTS linux-gcp-5.15 5.15.0-1041.49~20.04.1 —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 20.04 LTS linux-hwe-5.15 +1 5.15.0-83.92~20.04.1 —
Ubuntu 20.04 LTS linux-ibm-5.15 5.15.0-1037.40~20.04.1 —
Ubuntu 20.04 LTS linux-intel-iotg-5.15 5.15.0-1040.46~20.04.1 —
Ubuntu 20.04 LTS linux-nvidia-tegra-5.15 5.15.0-1017.17~20.04.1 —
Ubuntu 20.04 LTS linux-oracle-5.15 5.15.0-1042.48~20.04.1 —
Ubuntu 20.04 LTS linux-riscv-5.15 5.15.0-1040.44~20.04.3 —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-intel-iot-realtime 5.15.0-1038.40 —
Ubuntu Pro Realtime 22.04 LTS linux-realtime 5.15.0-1045.50 —
Ubuntu Pro FIPS 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 18.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 16.04 LTS linux-fips No fix yet —
Ubuntu Pro FIPS-updates 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 18.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 16.04 LTS linux-fips No fix yet —
Ubuntu Pro FIPS-preview 22.04 LTS linux-fips No fix yet —
Ubuntu Pro 20.04 LTS linux +10 No fix yet —
Ubuntu Pro 18.04 LTS linux +12 No fix yet —
Ubuntu Pro 16.04 LTS linux +7 No fix yet —
Ubuntu Pro 14.04 LTS linux-aws +2 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 9 bpftool 7.3.0-427.13.1.el9_4 RHSA-2024:2394
RHEL 9 rv +64 5.14.0-427.13.1.el9_4 RHSA-2024:2394
RHEL 8 kernel-rt +12 4.18.0-553.87.1.rt7.428.el8_10 RHSA-2025:22387
RHEL 8 perf +26 4.18.0-553.87.1.el8_10 RHSA-2025:22388
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.2 E4S bpftool 7.0.0-284.148.1.el9_2 RHSA-2025:22095
RHEL 9.2 E4S kernel-rt +14 5.14.0-284.148.1.rt14.433.el9_2 RHSA-2025:22124
RHEL 9.2 E4S perf +47 5.14.0-284.148.1.el9_2 RHSA-2025:22095
RHEL 9.0 E4S kernel-rt +12 5.14.0-70.158.1.rt21.230.el9_0 RHSA-2025:23424
RHEL 9.0 E4S perf +28 5.14.0-70.158.1.el9_0 RHSA-2025:23426
RHEL 8.8 TUS perf +17 4.18.0-477.124.1.el8_8 RHSA-2026:0532
RHEL 8.8 E4S perf +18 4.18.0-477.124.1.el8_8 RHSA-2026:0532
RHEL 8.6 TUS perf +17 4.18.0-372.175.1.el8_6 RHSA-2026:0536
RHEL 8.6 E4S perf +25 4.18.0-372.175.1.el8_6 RHSA-2026:0536
RHEL 8.6 AUS perf +17 4.18.0-372.175.1.el8_6 RHSA-2026:0536
RHEL 8.4 EUS Long Life perf +17 4.18.0-305.183.1.el8_4 RHSA-2026:0533
RHEL 8.4 AUS perf +17 4.18.0-305.183.1.el8_4 RHSA-2026:0533
RHEL 8.2 AUS perf +17 4.18.0-193.187.1.el8_2 RHSA-2026:3388

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 kernel-rt +9 4.18.0-553.87.1.rt7.428.el8_10 ALSA-2025:22387
AlmaLinux 8 perf +24 4.18.0-553.87.1.el8_10 ALSA-2025:22388

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 kernel 4.18.0-553.87.1.el8_10 RLSA-2025:22388
Rocky Linux 8 kernel-rt 4.18.0-553.87.1.rt7.428.el8_10 RLSA-2025:22387
ReleasePackageFixed inAdvisory
SLES 15 SP4 kernel-64kb +6 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLES 15 SP4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SLES for SAP 15 SP4 kernel-docs +4 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Micro 5.4 kernel-default 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Micro 5.4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SLE Micro 5.4 kernel-rt +1 5.14.21-150400.15.133.1 SUSE-SU-2025:3716-1
SLE Micro 5.3 kernel-default 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Micro 5.3 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SLE Micro 5.3 kernel-rt +1 5.14.21-150400.15.133.1 SUSE-SU-2025:3716-1
SLE Live Patching 15 SP4 kernel-default 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_45 1-150400.9.3.1 SUSE-SU-2025:03628-1
SLE HPC 15 SP4 kernel-64kb +5 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE HPC 15 SP4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SUSE Manager Server LTS 4.3 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SUSE Manager Server LTS 4.3 kernel-syms +3 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SUSE Manager Proxy LTS 4.3 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SUSE Manager Proxy LTS 4.3 kernel-syms +2 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 kernel-livepatch-6.1.34-56.100 1.0-0.amzn2023 ALAS2023-2023-228
Amazon Linux 2023 perf +12 6.1.34-56.100.amzn2023 ALAS2023-2023-228

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 perf +19 4.18.0-553.87.1.el8_10 ELSA-2025-22388

Advisories 20

References