CVE-2023-53791

A logic inconsistency was identified in the Linux kernel md (multiple device) driver involving the export_rdev() function and associated block device holder bookkeeping. Under certain sequences where mddev->external is toggled, the code would use one holder (claim_rdev) to get a block device but a different holder (rdev) to put it back, leading to a mismatch in reference accounting. This could result in spurious kernel warnings and potential resource lifetime misbehavior when interacting with md devices via sysfs

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.