CVE-2023-53360: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53360 affects the Linux kernel's NFSv4.2 implementation, specifically related to scratch handling for READPLUS operations. The vulnerability was discovered when it was found that the read code might send multiple requests using the same nfspgioheader, but nfs4procreadsetup() is only called once (Ubuntu Security).

The vulnerability stems from a situation where the read code might send multiple requests using the same nfspgioheader, while nfs4procreadsetup() is only called once. This leads to two critical issues: occasional double-freeing of the scratch buffer and setting a NULL pointer with non-zero length to the xdr scratch buffer. The latter results in a system crash (oops) when decoding needs to copy something to scratch, which frequently occurs when decoding READPLUS hole segments (Ubuntu Security).

When exploited, this vulnerability can cause system crashes due to NULL pointer dereference when decoding READ_PLUS hole segments. The issue specifically manifests when the system attempts to decode data with an invalid scratch buffer configuration (Ubuntu Security).

The fix involves moving scratch handling into the pageio read code. A function has been implemented to allocate scratch space for decoding read replies, and the scratch buffer is now freed when the nfspgioheader is freed (Ubuntu Security).