CVE-2023-53380

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request

There are two check of 'mreplace' in raid10_sync_request(). In the first check, 'need_replace' will be set and 'mreplace' will be used later if no-Faulty 'mreplace' exists, In the second check, 'mreplace' will be set to NULL if it is Faulty, but 'need_replace' will not be changed accordingly. null-ptr-deref occurs if Faulty is set between two check.

Fix it by merging two checks into one. And replace 'need_replace' with 'mreplace' because their values are always the same.

The bug is a race in raid10_sync_request() where mreplace could become Faulty between two checks, leaving need_replace true while the pointer was cleared, causing a NULL-pointer dereference during RAID10 resync. Exploitation requires very specific timing while a replacement/sync is in progress and typically administrative control over md/RAID or misbehaving hardware, so the realistic impact is a local kernel crash/DoS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.