vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-53803

scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()

HIGH
8.1
CVSS Score
Published: December 9, 2025 at 12:00 AM UTC
Updated: October 15, 2026 at 10:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() A fix for: BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271 Checking after (and before in next loop) addl_desc_ptr[1] is sufficient, we expect the size to be sanitized before first access to addl_desc_ptr[1]. Make sure we don't walk beyond end of page.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
2.6.3221fab1d0595eacf781705ec3509012a28f298245
Vendor states this is fixed in 0dfe68394cbe1d4fe579fb325ecc813c50528c5a (fixed)
Vendor states this is fixed in 2b28a7d261cb309912596d6a2d383ca370483527 (fixed)
Vendor states this is fixed in 467afb1dd630d8c6d172bd6cacc125199b5f4f2d (fixed)
Vendor states this is fixed in 799e8dd2022d2e13f0c5c1906b40ceca07a23349 (fixed)
Vendor states this is fixed in 9b4f5028e493cb353a5c8f5c45073eeea0303abd (fixed)
Vendor states this is fixed in 9e5c7d52085b8c84bc82a261580f0eb170039325 (fixed)
Vendor states this is fixed in da1a955c48a16e16e925d6544793914e52a6fa51 (fixed)
Vendor states this is fixed in e4dd25da784b2e07dbfbf04509afa4c5a1375227 (fixed)
Vendor states this is fixed in 2.6.32 (unaffected)
Vendor states this is fixed in 4.14.308 (unaffected)
Vendor states this is fixed in 4.19.276 (unaffected)
Vendor states this is fixed in 5.10.173 (unaffected)
Vendor states this is fixed in 5.15.99 (unaffected)
Vendor states this is fixed in 5.4.235 (unaffected)
Vendor states this is fixed in 6.1.16 (unaffected)
Vendor states this is fixed in 6.2.3 (unaffected)
Vendor states this is fixed in 6.3 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/da1a955c48a16e16e925d6544793914e52a6fa51
Source: cverecord
https://git.kernel.org/stable/c/9e5c7d52085b8c84bc82a261580f0eb170039325
Source: cverecord
https://git.kernel.org/stable/c/467afb1dd630d8c6d172bd6cacc125199b5f4f2d
Source: cverecord
https://git.kernel.org/stable/c/e4dd25da784b2e07dbfbf04509afa4c5a1375227
Source: cverecord
https://git.kernel.org/stable/c/2b28a7d261cb309912596d6a2d383ca370483527
Source: cverecord
https://git.kernel.org/stable/c/0dfe68394cbe1d4fe579fb325ecc813c50528c5a
Source: cverecord
https://git.kernel.org/stable/c/799e8dd2022d2e13f0c5c1906b40ceca07a23349
Source: cverecord
https://git.kernel.org/stable/c/9b4f5028e493cb353a5c8f5c45073eeea0303abd

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.1HIGHLinux
Vector?

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card