CVE-2023-52983: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52983 is a vulnerability in the Linux kernel related to a use-after-free (UAF) issue in the block, bfq component. The vulnerability was discovered and disclosed on March 27, 2025, affecting Linux kernel versions from 5.15.86 up to 5.15.93 and from 6.1.2 up to 6.1.11, as well as version 6.0.16 (NVD).

The vulnerability occurs in the bicsetbfqq() function where bic->bfqq is accessed after being freed in certain contexts. This issue emerged after commit 64dc8c732f5c which attempted to fix a possible use-after-free for 'bfqq->bic'. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements but high impact potential (NVD).

The vulnerability could potentially lead to high-severity impacts on system confidentiality, integrity, and availability when successfully exploited, as indicated by the CVSS scoring (NVD).

The vulnerability has been fixed in various Linux distributions. Ubuntu has released patches for version 22.04 LTS (5.15.0-72.79), and similar fixes have been implemented for other affected versions including AWS, Azure, and Oracle Linux variants (Ubuntu). The fix involves ensuring that bfqq is always freed after bicsetbfqq().