CVE-2023-53555 Details
Description
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: initialize damo_filter->list from damos_new_filter() damos_new_filter() is not initializing the list field of newly allocated filter object. However, DAMON sysfs interface and DAMON_RECLAIM are not initializing it after calling damos_new_filter(). As a result, accessing uninitialized memory is possible. Actually, adding multiple DAMOS filters via DAMON sysfs interface caused NULL pointer dereferencing. Initialize the field just after the allocation from damos_new_filter().
A vulnerability in the Linux kernel's DAMON (Data Access Monitoring) subsystem allows for uninitialized memory access, which can lead to NULL pointer dereferencing. This issue arises because the 'list' field of newly allocated DAMOS (DAMOS Object) filter objects is not properly initialized. While the DAMON sysfs interface and DAMON_RECLAIM should initialize this field, they fail to do so after calling the 'damos_new_filter()' function'. As a result, accessing uninitialized memory becomes possible. The vulnerability was introduced in version 6.4 and persists in the stable branch through 6.5.1. The issue has been resolved by modifying the 'damos_new_filter()' function' to initialize the 'list' field immediately after allocating a new filter object.
Users can upgrade to the latest version of the Linux kernel to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/5f1fc67f2cb8d3035d3acd273b48b97835af8afd | kernel.org | Patch |
| https://git.kernel.org/stable/c/da7beebb49c643cd03c54447ed66595936a7a1ce | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.3, < 6.4.11 6.5 rc1 6.5 rc2 6.5 rc3 6.5 rc4 6.5 rc5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Mar 23, 2026 | Modified Analysis | [email protected] |
| Feb 12, 2026 | Initial Analysis | [email protected] |
| Oct 4, 2025 | New CVE Received | kernel.org |