CVE-2023-53376

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Use number of bits to manage bitmap sizes To allocate bitmaps, the mpi3mr driver calculates sizes of bitmaps using byte as unit. However, bitmap helper functions assume that bitmaps are allocated using unsigned long as unit. This gap causes memory access beyond the bitmap sizes and results in "BUG: KASAN: slab-out-of-bounds". The BUG was observed at firmware download to eHBA-9600. Call trace indicated that the out-of-bounds access happened in find_first_zero_bit() called from mpi3mr_send_event_ack() for miroc->evtack_cmds_bitmap. To fix the BUG, do not use bytes to manage bitmap sizes. Instead, use number of bits, and call bitmap helper functions which take number of bits as arguments. For memory allocation, call bitmap_zalloc() instead of kzalloc() and krealloc(). For memory free, call bitmap_free() instead of kfree(). For zero clear, call bitmap_clear() instead of memset(). Remove three fields for bitmap byte sizes in struct scmd_priv which are no longer required. Replace the field dev_handle_bitmap_sz with dev_handle_bitmap_bits to keep number of bits of removepend_bitmap across resize.

• CWE-125
• CWE-125

• https://git.kernel.org/stable/c/339e61565f81a6534afdc18fd854b2e2628bf5dbPatch
• https://git.kernel.org/stable/c/6a675a6d57d31da43d8da576465c1cd5d5b0bd3dPatch
• https://git.kernel.org/stable/c/8ac713d2e9845e9234bb12ae5903040685d5aff9Patch

Published

Sep 18, 2025

Last Modified

Aug 4, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-53370In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-53371In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-53372In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-53373In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-53374In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-53375In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-53377In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-53378In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-53379In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-5338The Theme Blvd Shortcodes plugin for WordPress is vulnerable…5.4
• CVE-2023-53380In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-53381In the Linux kernel, the following vulnerability has been re…5.5