CVE-2023-53494

What it actually does

The xts crypto implementation frees request data upon any return value other than EINPROGRESS, but fails to handle EBUSY returned when MAY_BACKLOG is specified, leaving backlogged requests to trigger a use-after-free.

Why it matters to the business

Kernel crashes, memory corruption, or potential local privilege escalation on systems using the affected crypto xts code, with highest urgency on Debian 11/12/13/14 deployments still running pre-5.10.84 or pre-5.15.5 kernels.

How an attack unfolds

An attacker triggers xts encryption/decryption operations that specify MAY_BACKLOG, forces the underlying driver to return EBUSY, and reuses the freed request structure to corrupt kernel memory; related container privilege-escalation techniques observed in campaigns targeting Container-Optimized OS.

How to fix it

Upgrade linux to Debian 11 fixed version 5.10.84-1, Debian 12/13/14 to 5.15.5-1, or apply commit 92a07ba4f0af2cccdc2aa5ee32679c9c9714db90 from the stable git tree; reboot after package installation.

How to confirm the fix worked

Confirm the running kernel contains commit 92a07ba4f0af2cccdc2aa5ee32679c9c9714db90 or the listed Debian package versions; recompile and test xts with MAY_BACKLOG requests to verify EBUSY is handled identically to EINPROGRESS.

Typical attack path

1. Identify a process or kernel path performing xts crypto with MAY_BACKLOG flag
2. Induce EBUSY return from the async crypto driver
3. Trigger reuse of the prematurely freed request structure
4. Achieve memory corruption leading to code execution or denial of service

How to detect it

Review kernel logs for xts-related use-after-free warnings or BUGs around crypto request handling; correlate with process activity performing async encryption that may set MAY_BACKLOG; look for post-exploitation artifacts associated with container privilege-escalation attempts.

What your security team should do

• Prioritize patching all Debian 11/12/13/14 systems within the CISA-style remediation window
• Scan for and upgrade any custom kernels built before the referenced commit
• Monitor container workloads for unexpected xts crypto usage
• Apply kernel live-patching where available until full reboot is possible