CVE-2023-53241

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-53241
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53241.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-53241
Downstream
Published
2025-09-15T15:15:51Z
Modified
2025-09-15T20:01:25Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

nfsd: call oprelease, even when opfunc returns an error

For ops with "trivial" replies, nfsd4encodeoperation will shortcut most of the encoding work and skip to just marshalling up the status. One of the things it skips is calling op_release. This could cause a memory leak in the layoutget codepath if there is an error at an inopportune time.

Have the compound processing engine always call oprelease, even when opfunc sets an error in op->status. With this change, we also need nfsd4blockgetdeviceinfoscsi to set the gddevice pointer to NULL on error to avoid a double free.

References

Affected packages