vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-54046

crypto: essiv - Handle EBUSY correctly

HIGH
7.8
CVSS Score
Published: December 24, 2025 at 12:22 PM UTC
Updated: October 15, 2026 at 10:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of essiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
5.4be1eb7f78aa8fbe34779c56c266ccd0364604e71
Vendor states this is fixed in 69c67d451fc19d88e54f7d97e8e7c093e08357e1 (fixed)
Vendor states this is fixed in 796e02cca30a67322161f0745e5ce994bbe75605 (fixed)
Vendor states this is fixed in 840a1d3b77c1b062bd62b4733969a5b1efc274ce (fixed)
Vendor states this is fixed in a006aa3eedb8bfd6fe317c3cfe9c86ffe76b2385 (fixed)
Vendor states this is fixed in b5a772adf45a32c68bef28e60621f12617161556 (fixed)
Vendor states this is fixed in c61e7d182ee3f3f5ecf18a2964e303d49c539b52 (fixed)
Vendor states this is fixed in 5.10.173 (unaffected)
Vendor states this is fixed in 5.15.99 (unaffected)
Vendor states this is fixed in 5.4 (unaffected)
Vendor states this is fixed in 5.4.235 (unaffected)
Vendor states this is fixed in 6.1.16 (unaffected)
Vendor states this is fixed in 6.2.3 (unaffected)
Vendor states this is fixed in 6.3 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (6)

Source: cverecord
https://git.kernel.org/stable/c/c61e7d182ee3f3f5ecf18a2964e303d49c539b52
Source: cverecord
https://git.kernel.org/stable/c/796e02cca30a67322161f0745e5ce994bbe75605
Source: cverecord
https://git.kernel.org/stable/c/840a1d3b77c1b062bd62b4733969a5b1efc274ce
Source: cverecord
https://git.kernel.org/stable/c/a006aa3eedb8bfd6fe317c3cfe9c86ffe76b2385
Source: cverecord
https://git.kernel.org/stable/c/69c67d451fc19d88e54f7d97e8e7c093e08357e1
Source: cverecord
https://git.kernel.org/stable/c/b5a772adf45a32c68bef28e60621f12617161556

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card