CVE-2023-53576

A missing validation flaw was found in the Linux kernel null_blk driver's configuration handling. A local user with access to configfs can configure a null_blk device with queue_mode set to 1 (legacy I/O path), which is no longer supported, causing the driver to proceed without proper validation and triggering a kernel oops and denial of service through system crash.

The null_validate_conf() function fails to check the device queue mode setting when configured via configfs. When userspace sets queue_mode to 1 (NULL_Q_RQ, representing the legacy request-based I/O path), the driver should reject this configuration since the legacy path has been removed. Instead, the driver accepts the invalid mode and attempts to initialize with it, causing a kernel oops when the incompatible code paths execute.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the null_blk module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.