CVE-2023-53005 — trace_events_hist: add check for return value of 'create_hist_field'

Back Back to CVE browser

MEDIUM

trace_events_hist: add check for return value of 'create_hist_field'

Published Mar 27, 2025

5.5

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

Function 'create_hist_field' is called recursively at trace_events_hist.c:1954 and can return NULL-value that's why we have to check it to avoid null pointer dereference.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  4.17
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <4.17
- Version
  4.19.272
  Status
  unaffected
  Constraints
  <=4.19.*
- Version
  5.10.166
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.91
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  5.4.231
  Status
  unaffected
  Constraints
  <=5.4.*
- Version
  6.1.9
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.2
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
4.17	affected	-
0	unaffected	<4.17
4.19.272	unaffected	<=4.19.*
5.10.166	unaffected	<=5.10.*
5.15.91	unaffected	<=5.15.*
5.4.231	unaffected	<=5.4.*
6.1.9	unaffected	<=6.1.*
6.2	unaffected	<=*

Red Hat Enterprise Linux 10

kernel

Not affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Out of support scope
Red Hat Enterprise Linux 8

kernel-rt

Out of support scope
Red Hat Enterprise Linux 9

kernel

Fix deferred
Red Hat Enterprise Linux 9

kernel-rt

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 8	kernel-rt	Out of support scope	n/a
Red Hat Enterprise Linux 9	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel-rt	Fix deferred	n/a

Remediation

No remediation recorded yet.

Metrics

0.26% 0.00264

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00264

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.26% (0.00264)	16.66th	v5 (v2026.06.15)
Jun 15, 2026	0.22% (0.00219)	12.18th	v5 (v2026.06.15)
Mar 28, 2025	0.02% (0.00023)	3.68th	v4 (v2025.03.14)

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (11)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-53005		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2355452		Issue Tracking
https://git.kernel.org/stable/c/31b2414abeaa6de0490e85164badc6dcb1bb8ec9		Patch
https://git.kernel.org/stable/c/592ba7116fa620425725ff0972691f352ba3caf6		Patch
https://git.kernel.org/stable/c/886aa449235f478e262bbd5dcdee6ed6bc202949		Patch
https://git.kernel.org/stable/c/8b152e9150d07a885f95e1fd401fc81af202d9a4		Patch
https://git.kernel.org/stable/c/b4e7e81b4fdfcf457daee6b7a61769f62198d840		Patch
https://git.kernel.org/stable/c/d2d1ada58e7cc100b8d7d6b082d19321ba4a700a		Patch
https://lore.kernel.org/linux-cve-announce/2025032713-CVE-2023-53005-9bf0@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-53005
https://www.cve.org/CVERecord?id=CVE-2023-53005