Medium

Linux Kernel NBD ioctl Argument Validation Integer Overflow

IdentifiersCVE-2023-53513CWE-190

CVE-2023-53513 is an incomplete input-validation vulnerability in the Linux kernel Network Block Device (NBD) subsystem. The NBD ioctl handler accepts insufficiently bounded arguments. A maliciously large size argument can propagate through nbd_set_size() to inode->i_size; subsequent evaluation of i_size_read(inode) - 1 in the block write path can cause signed integer overflow. Separately, an oversized ioctl argument supplied to nbd_add_socket() can be narrowed to an int, resulting in truncation and unintended behavior. The upstream fix adds bounds checks that reject excessively large ioctl argument values.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

A local attacker able to invoke affected NBD ioctls can trigger undefined kernel behavior, including a signed integer overflow in the block write path, potentially causing a kernel crash or denial of service. Integer truncation in the socket-addition path can also cause unexpected operation. Red Hat assesses potential confidentiality impact as high, integrity impact as low, and availability impact as high; practical impact beyond denial of service depends on kernel configuration and exploitability in the affected environment.

Mitigation

If you can’t patch tonight, do this now.

Where immediate patching is not possible, restrict access to NBD device nodes and ioctl interfaces to trusted administrators, prevent untrusted users and containers from accessing NBD devices, and unload or blacklist the NBD module on systems where it is not required. No broadly applicable vendor-supported workaround is available.

Remediation

Patch, then assume compromise.

Update to a vendor-supported kernel containing the NBD ioctl validation fix. Upstream fixed releases include Linux kernel 5.15.113, 6.1.30, 6.3.4, and 6.4; use a current stable kernel release rather than selectively applying an individual commit. Install applicable vendor kernel or kernel-rt security updates and reboot to run the patched kernel.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

LinuxLinux Kerneloperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

17 SOURCESView more in app

redhat accessNews

Feb 26, 2026

RHSA-2026:3388 - Security Advisory - Red Hat Customer Portal

A Linux kernel nbd vulnerability caused by incomplete validation of an ioctl argument.

redhat accessNews

Jan 14, 2026

RHSA-2026:0533 - Security Advisory - Red Hat Customer Portal

A Linux kernel Network Block Device (NBD) flaw caused by incomplete validation of an ioctl argument.

redhat accessNews

Jan 14, 2026

RHSA-2026:0532 - Security Advisory - Red Hat Customer Portal

A Linux kernel Network Block Device (NBD) flaw caused by incomplete validation of an ioctl argument.

redhat accessNews

Jan 14, 2026

RHSA-2026:0536 - Security Advisory - Red Hat Customer Portal

An incomplete ioctl argument-validation vulnerability in the Linux kernel Network Block Device (NBD) subsystem.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3