CVE-2023-53832

A null pointer dereference flaw was found in the Linux kernel's RAID10 implementation. When recovery is skipped on a clean array, init_resync() is called but close_sync() is not, leaving conf->have_replacement incorrectly set to 0. If a replacement device is later added and recovery is triggered, repl_bio is not allocated, causing a null pointer dereference when accessed.

Exploitation requires specific RAID10 array operations including adding replacement devices after skipped recovery cycles. This represents a reliability issue for systems using RAID10 with device replacement workflows.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.