kobject: Add sanity check for kset->kobj.ktype in kset_register()
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-476.
Summary
In the Linux kernel, the following vulnerability has been resolved: kobject: Add sanity check for kset->kobj.ktype in kset_register() When I register a kset in the following way: static struct kset my_kset; kobject_set_name(&my_kset.kobj, "my_kset"); ret = kset_register(&my_kset); A null pointer dereference exception is occurred: [ 4453.568337] Unable to handle kernel NULL pointer dereference at \ virtual address 0000000000000028 ... ... [ 4453.810361] Call trace: [ 4453.813062] kobject_get_ownership+0xc/0x34 [ 4453.817493] kobject_add_internal+0x98/0x274 [ 4453.822005] kset_register+0x5c/0xb4 [ 4453.825820] my_kobj_init+0x44/0x1000 [my_kset] ... ... Because I didn't initialize my_kset.kobj.ktype. According to the description in Documentation/core-api/kobject.rst: - A ktype is the type of object that embeds a kobject. Every structure that embeds a kobject needs a corresponding ktype. So add sanity check to make sure kset->kobj.ktype is not NULL.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 4.19 and later | 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55, 6.5.5, 6.6 | Patch available | CNA |
- Linux VendorLinux Affected 4.19 and later Fixed in 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55, 6.5.5, 6.6 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.19 to before 4.19.295; 4.20 to before 5.4.257; 5.5 to before 5.10.197; 5.11 to before 5.15.133; 5.16 to before 6.1.55; 6.2 to before 6.5.5 | Vulnerable | Linux |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.19 to before 4.19.295; 4.20 to before 5.4.257; 5.5 to before 5.10.197; 5.11 to before 5.15.133; 5.16 to before 6.1.55; 6.2 to before 6.5.5 Vulnerable ·Linux
Remediation
- Fix · CNA Linux (Linux) Fixed in 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55, 6.5.5, 6.6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Enterprise Linux 10
Timeline
- 2026-10-02 Threatist record created from CVE-2023-53480
- 2026-10-03 Alias added: GHSA-8xg4-jw8q-mm7v
- 2026-11-05 CISA SSVC decision points changed
References
Patch 7
- https://git.kernel.org/stable/c/039ec9db2d30032eafa365f5f89b30eca5322b05
- https://git.kernel.org/stable/c/964e025ceefdf75da46b0133d0c2790de451aeec
- https://git.kernel.org/stable/c/5df5829158513134ddcaf2184d9286eda7b0bb18
- https://git.kernel.org/stable/c/f3f6bf22a4f5ba649cf26ae4670de5c7f861bdef
- https://git.kernel.org/stable/c/48aebbe801e78a8932404c122ed0e880ccedc220
- https://git.kernel.org/stable/c/1a772881bc059c596d8ca587cbd2a233edce3d3b
- https://git.kernel.org/stable/c/4d0fe8c52bb3029d83e323c961221156ab98680b
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
Sources
- CVE-2023-53480 · CVE Program
- CVE-2023-53480 · NVD
- FIRST EPSS
- GHSA-8xg4-jw8q-mm7v · GitHub Advisory Database · CC BY 4.0
- CVE-2023-53480 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences