CVE-2023-53722: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53722 is an out-of-bounds (OOB) access vulnerability in the Linux kernel's RAID1 implementation, specifically within the raid1_remove_disk() function. The flaw occurs when rddev->raid_disk is greater than mddev->raid_disks, resulting in an out-of-bounds memory access. It affects the Linux kernel across a wide range of versions and was published on October 22, 2025. The vulnerability carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Feedly).

The root cause is an insufficient bounds check in the raid1_remove_disk() function of the Linux kernel's MD (Multiple Devices) RAID1 subsystem, classified as CWE-125 (Out-of-bounds Read). When a disk is removed from a RAID1 array, the function uses rddev->raid_disk as an index into an array bounded by mddev->raid_disks; if the former exceeds the latter, an out-of-bounds memory access occurs. The fix involves validating the number variable before using it as an array index, consistent with similar fixes applied to RAID10 (commit d17f744e883b) and RAID5 (commit 1ebc2cec0b7d). Exploitation requires low-privileged local access and has high attack complexity (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation could result in system instability, kernel crashes, data corruption within RAID1 storage configurations, or potentially arbitrary code execution in the kernel context. The vulnerability affects confidentiality, integrity, and availability — all rated High in the CVSS scoring. Given its local attack vector, the primary risk is privilege escalation or denial of service on systems using RAID1 arrays managed by the Linux MD subsystem (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.024%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and high attack complexity, limiting the practical attack surface (Feedly, Red Hat CVE).

Patches have been backported and applied across multiple stable Linux kernel versions. Administrators should update to one of the following patched versions or later: 4.14.326, 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55, 6.5.5, or 6.6. As interim mitigations, restrict local user access to RAID management interfaces and monitor system logs for unusual RAID-related activity. Distribution-specific updates are available from vendors including SUSE and openSUSE (Red Hat Bugzilla, Feedly).