CVE-2023-53373 [High] | Use-After-Free in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of seqiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.02%	0.15%	+0.13%
2	2025-09-19	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.02%

0.15%

+0.13%

2025-09-19

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.8	3.1	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	5.9	[email protected]
7.8	3.1	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	5.9	134c704f-9b21-4f2e-91b3-4a467353bcc0

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.8

3.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

5.9

[email protected]

7.8

3.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

5.9

134c704f-9b21-4f2e-91b3-4a467353bcc0

OS Trackers for CVE-2023-53373

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2023-53373 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2023-53373
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2023-53373
`suse`	medium	—	https://www.suse.com/security/cve/CVE-2023-53373/
`ubuntu`	medium	CVE-2023-53373 medium priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1414 status rows across 9 suites (bionic, focal, jammy, noble, plucky, questing, trusty, upstream, xenial): DNE 1017, ignored 162, released 139, not-affected 76, needed 19, needs-triage 1.	https://ubuntu.com/security/CVE-2023-53373

Affected software / configurations for CVE-2023-53373

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 2.6.25, < 4.14.308	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 4.15, < 4.19.276	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 4.20, < 5.4.235	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.5, < 5.10.173	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.11, < 5.15.99	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.16, < 6.1.16	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.2, < 6.2.3	cpe:2.3:o:linux:linux_kernel::::::::

References for CVE-2023-53373

URL	Tags
https://git.kernel.org/stable/c/1effbddaff60eeef8017c6dea1ee0ed970164d14	Patch
https://git.kernel.org/stable/c/32e62025e5e52fbe4812ef044759de7010b15dbc	Patch
https://git.kernel.org/stable/c/36ec108b7bd7e280edb22de028467bd09d644620	Patch
https://git.kernel.org/stable/c/4d497e8b200a175094e0ac252ed878add39b8771	Patch
https://git.kernel.org/stable/c/63551e4b7cbcd9914258827699eb2cb6ed6e4a16	Patch
https://git.kernel.org/stable/c/9477db935eb690f697d9bcc4f608927841bc8b36	Patch
https://git.kernel.org/stable/c/ae849d2f48019ff9c104e32bf588ccbfb200e971	Patch
https://git.kernel.org/stable/c/cc4d0d4251748a8a68026938f4055d2ac47c5719	Patch

URL

CVE-2023-53373 | crypto: seqiv - Handle EBUSY correctly

Exploit prediction scoring system (EPSS) score for CVE-2023-53373

Common vulnerability scoring system (CVSS) metrics for CVE-2023-53373

Weakness enumeration for CVE-2023-53373

OS Trackers for CVE-2023-53373

Affected software / configurations for CVE-2023-53373

References for CVE-2023-53373