{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2023-53560",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-10-04T15:14:15.923Z",
        "datePublished": "2025-10-04T15:17:04.299Z",
        "dateUpdated": "2026-08-04T09:15:24.750Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-04T09:15:24.750Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Add histograms to hist_vars if they have referenced variables\n\nHist triggers can have referenced variables without having direct\nvariables fields. This can be the case if referenced variables are added\nfor trigger actions. In this case the newly added references will not\nhave field variables. Not taking such referenced variables into\nconsideration can result in a bug where it would be possible to remove\nhist trigger with variables being refenced. This will result in a bug\nthat is easily reproducable like so\n\n$ cd /sys/kernel/tracing\n$ echo 'synthetic_sys_enter char[] comm; long id' >> synthetic_events\n$ echo 'hist:keys=common_pid.execname,id.syscall:vals=hitcount:comm=common_pid.execname' >> events/raw_syscalls/sys_enter/trigger\n$ echo 'hist:keys=common_pid.execname,id.syscall:onmatch(raw_syscalls.sys_enter).synthetic_sys_enter($comm, id)' >> events/raw_syscalls/sys_enter/trigger\n$ echo '!hist:keys=common_pid.execname,id.syscall:vals=hitcount:comm=common_pid.execname' >> events/raw_syscalls/sys_enter/trigger\n\n[  100.263533] ==================================================================\n[  100.264634] BUG: KASAN: slab-use-after-free in resolve_var_refs+0xc7/0x180\n[  100.265520] Read of size 8 at addr ffff88810375d0f0 by task bash/439\n[  100.266320]\n[  100.266533] CPU: 2 PID: 439 Comm: bash Not tainted 6.5.0-rc1 #4\n[  100.267277] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-20220807_005459-localhost 04/01/2014\n[  100.268561] Call Trace:\n[  100.268902]  <TASK>\n[  100.269189]  dump_stack_lvl+0x4c/0x70\n[  100.269680]  print_report+0xc5/0x600\n[  100.270165]  ? resolve_var_refs+0xc7/0x180\n[  100.270697]  ? kasan_complete_mode_report_info+0x80/0x1f0\n[  100.271389]  ? resolve_var_refs+0xc7/0x180\n[  100.271913]  kasan_report+0xbd/0x100\n[  100.272380]  ? resolve_var_refs+0xc7/0x180\n[  100.272920]  __asan_load8+0x71/0xa0\n[  100.273377]  resolve_var_refs+0xc7/0x180\n[  100.273888]  event_hist_trigger+0x749/0x860\n[  100.274505]  ? kasan_save_stack+0x2a/0x50\n[  100.275024]  ? kasan_set_track+0x29/0x40\n[  100.275536]  ? __pfx_event_hist_trigger+0x10/0x10\n[  100.276138]  ? ksys_write+0xd1/0x170\n[  100.276607]  ? do_syscall_64+0x3c/0x90\n[  100.277099]  ? entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n[  100.277771]  ? destroy_hist_data+0x446/0x470\n[  100.278324]  ? event_hist_trigger_parse+0xa6c/0x3860\n[  100.278962]  ? __pfx_event_hist_trigger_parse+0x10/0x10\n[  100.279627]  ? __kasan_check_write+0x18/0x20\n[  100.280177]  ? mutex_unlock+0x85/0xd0\n[  100.280660]  ? __pfx_mutex_unlock+0x10/0x10\n[  100.281200]  ? kfree+0x7b/0x120\n[  100.281619]  ? ____kasan_slab_free+0x15d/0x1d0\n[  100.282197]  ? event_trigger_write+0xac/0x100\n[  100.282764]  ? __kasan_slab_free+0x16/0x20\n[  100.283293]  ? __kmem_cache_free+0x153/0x2f0\n[  100.283844]  ? sched_mm_cid_remote_clear+0xb1/0x250\n[  100.284550]  ? __pfx_sched_mm_cid_remote_clear+0x10/0x10\n[  100.285221]  ? event_trigger_write+0xbc/0x100\n[  100.285781]  ? __kasan_check_read+0x15/0x20\n[  100.286321]  ? __bitmap_weight+0x66/0xa0\n[  100.286833]  ? _find_next_bit+0x46/0xe0\n[  100.287334]  ? task_mm_cid_work+0x37f/0x450\n[  100.287872]  event_triggers_call+0x84/0x150\n[  100.288408]  trace_event_buffer_commit+0x339/0x430\n[  100.289073]  ? ring_buffer_event_data+0x3f/0x60\n[  100.292189]  trace_event_raw_event_sys_enter+0x8b/0xe0\n[  100.295434]  syscall_trace_enter.constprop.0+0x18f/0x1b0\n[  100.298653]  syscall_enter_from_user_mode+0x32/0x40\n[  100.301808]  do_syscall_64+0x1a/0x90\n[  100.304748]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n[  100.307775] RIP: 0033:0x7f686c75c1cb\n[  100.310617] Code: 73 01 c3 48 8b 0d 65 3c 10 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 21 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 35 3c 10 00 f7 d8 64 89 01 48\n[  100.317847] RSP: 002b:00007ffc60137a38 EFLAGS: 00000246 ORIG_RAX: 0000000000000021\n[  100.321200] RA\n---truncated---"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    }
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "kernel/trace/trace_events_hist.c"
                    ],
                    "versions": [
                        {
                            "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
                            "lessThan": "4ffad1528e81c91769d9da1f8436080861c8ec67",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
                            "lessThan": "4815359056083c555f97a5ee3af86519be5166de",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
                            "lessThan": "1576f0df7b4d1f82db588d6654b89d796fa06929",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
                            "lessThan": "97f54b330c797ed27fba8791baeaa38ace886cbd",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
                            "lessThan": "5fd32eb6fa0ac795aa5a64bc004ab68d7b44196a",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
                            "lessThan": "4a540f63618e525e433b37d2b5522cda08e321d7",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
                            "lessThan": "6018b585e8c6fa7d85d4b38d9ce49a5b67be7078",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "kernel/trace/trace_events_hist.c"
                    ],
                    "versions": [
                        {
                            "version": "4.17",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "4.17",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "4.19.291",
                            "lessThanOrEqual": "4.19.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.4.251",
                            "lessThanOrEqual": "5.4.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.10.188",
                            "lessThanOrEqual": "5.10.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.121",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.40",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.4.5",
                            "lessThanOrEqual": "6.4.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.5",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "4.19.291"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "5.4.251"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "5.10.188"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "5.15.121"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "6.1.40"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "6.4.5"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.17",
                                    "versionEndExcluding": "6.5"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/4ffad1528e81c91769d9da1f8436080861c8ec67"
                },
                {
                    "url": "https://git.kernel.org/stable/c/4815359056083c555f97a5ee3af86519be5166de"
                },
                {
                    "url": "https://git.kernel.org/stable/c/1576f0df7b4d1f82db588d6654b89d796fa06929"
                },
                {
                    "url": "https://git.kernel.org/stable/c/97f54b330c797ed27fba8791baeaa38ace886cbd"
                },
                {
                    "url": "https://git.kernel.org/stable/c/5fd32eb6fa0ac795aa5a64bc004ab68d7b44196a"
                },
                {
                    "url": "https://git.kernel.org/stable/c/4a540f63618e525e433b37d2b5522cda08e321d7"
                },
                {
                    "url": "https://git.kernel.org/stable/c/6018b585e8c6fa7d85d4b38d9ce49a5b67be7078"
                }
            ],
            "title": "tracing/histograms: Add histograms to hist_vars if they have referenced variables",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}