CVE-2023-53320: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53320 is an out-of-bounds write vulnerability in the Linux kernel's SCSI mpi3mr driver, specifically within the mpi3mr_get_all_tgt_info() function. The flaw affects Linux kernel versions 5.19 through 6.1.15 and 6.2 through 6.2.2, with fixes introduced in versions 6.1.16 and 6.2.3. It was publicly disclosed on September 16, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-787 (Out-of-bounds Write) and stems from four distinct coding errors in mpi3mr_get_all_tgt_info(): (1) the header size of struct mpi3mr_device_map_info is incorrectly assumed to be sizeof(u32) instead of the correct sizeof(u64); (2) the valid entry length kern_entrylen is miscalculated by subtracting 1 from num_devices; (3) num_device is copied via memcpy() where a simple assignment suffices; and (4) the payload length — which is larger than the actual alltgt_info buffer — is incorrectly passed to sg_copy_from_buffer(), triggering a BUG: KASAN: slab-out-of-bounds kernel error. Exploitation requires local, low-privileged access to the affected system (Red Hat Bugzilla, Feedly).

Successful exploitation of this vulnerability can result in high impacts to confidentiality, integrity, and availability of the affected system. A local attacker with low privileges could trigger a slab out-of-bounds memory write, potentially leading to kernel memory corruption, unauthorized data access or manipulation, and system crashes or denial of service. The vulnerability is confined to the local system scope but could serve as a stepping stone for privilege escalation (Red Hat Advisory, Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term (Feedly).

The Linux kernel project has released patches addressing all four issues in mpi3mr_get_all_tgt_info(). Affected systems should be updated to kernel version 6.1.16 or later (for the 5.19–6.1.x branch) or 6.2.3 or later (for the 6.2.x branch). Patches are available via the upstream kernel stable tree. As interim measures, administrators should restrict local user privileges and monitor for unusual kernel memory errors or KASAN warnings (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).