CVE-2023-53521

scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()

HIGH

7.1

CVSS Score

Published: October 1, 2025 at 11:46 AM UTC

Updated: June 17, 2026 at 06:45 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.1

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() A fix for: BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses] Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/12013 When edev->components is zero, accessing edev->component[0] members is wrong.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

2.6.25 ≤ v < 4.14.3082.6.25 ≤ v < 4.19.2762.6.25 ≤ v < 5.10.1732.6.25 ≤ v < 5.15.992.6.25 ≤ v < 5.4.2352.6.25 ≤ v < 6.1.162.6.25 ≤ v < 6.2.32.6.25 ≤ v < 6.34.15 ≤ v < 4.19.2764.20 ≤ v < 5.4.2355.11 ≤ v < 5.15.995.16 ≤ v < 6.1.165.5 ≤ v < 5.10.1736.2 ≤ v < 6.2.32.6.259927c68864e9c39cc317b4f559309ba29e642168

Vendor states this is fixed in 0595cdb587726b4f0fa780eb7462e3679d141e82 (fixed)

Vendor states this is fixed in 2fb1fa8425cce2dc4dce298275d22d7077694b73 (fixed)

Vendor states this is fixed in 40af9a6deed723485e05b7d3255a28750692e8db (fixed)

Vendor states this is fixed in 578797f0c8cbc2e3ec5fc0dab87087b4c7073686 (fixed)

Vendor states this is fixed in 76f7050537476ac062ec23a544fbca8270f2d08b (fixed)

Vendor states this is fixed in 82143faf01dda831b89eccef60c39ef8575ab08a (fixed)

Vendor states this is fixed in 87e47be38d205df338c52ead43f23b2864567423 (fixed)

Vendor states this is fixed in 8f9542cad6c27297c8391de3a659f0b7948495d0 (fixed)

Vendor states this is fixed in 2.6.25 (unaffected)

Vendor states this is fixed in 4.14.308 (unaffected)

Vendor states this is fixed in 4.19.276 (unaffected)

Vendor states this is fixed in 5.10.173 (unaffected)