CVE-2023-53722

In the Linux kernel, the following vulnerability has been resolved:

md: raid1: fix potential OOB in raid1_remove_disk()

If rddev->raid_disk is greater than mddev->raid_disks, there will be an out-of-bounds in raid1_remove_disk(). We have already found similar reports as follows:

1. commit d17f744e883b ("md-raid10: fix KASAN warning")
2. commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")

Fix this bug by checking whether the "number" variable is valid.

Fixes a potential out-of-bounds access in raid1_remove_disk() when rdev->raid_disk exceeds the configured number of RAID1 mirrors, which could dereference beyond conf->mirrors. Practically this can lead to a kernel crash (DoS) during array reconfiguration or disk removal, but it requires root/RAID management privileges to reach this path (e.g., via mdadm), not ordinary I/O or remote traffic. For the CVSS the PR:H because triggering it requires high-privilege md/raid control operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.