CVE-2023-53804

nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()

HIGH
7.8
CVSS Score
Published: December 9, 2025 at 12:01 AM UTC
Updated: August 5, 2026 at 10:24 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). However, since nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may cause use-after-free read if inodes are left in "garbage_list" and released by nilfs_dispose_list() at the end of nilfs_detach_log_writer(). Fix this issue by modifying nilfs_evict_inode() to only clear inode without additional metadata changes that use nilfs_root if the file system is degraded to read-only or the writer is detached.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

2.6.37 ≤ v < 4.14.3162.6.37 ≤ v < 4.19.2842.6.37 ≤ v < 5.10.1812.6.37 ≤ v < 5.15.1132.6.37 ≤ v < 5.4.2442.6.37 ≤ v < 6.1.302.6.37 ≤ v < 6.3.42.6.37 ≤ v < 6.42.6.37e912a5b66837ee89fb025e67b5efeaa11930c2ce
Vendor states this is fixed in 116d53f09ff52e6f98e3fe1f85d8898d6ba26c68 (fixed)
Vendor states this is fixed in 2a782ea8ebd712a458466e3103e2881b4f886cb5 (fixed)
Vendor states this is fixed in 6b4205ea97901f822004e6c8d59484ccfda03faa (fixed)
Vendor states this is fixed in 9b5a04ac3ad9898c4745cba46ea26de74ba56a8e (fixed)
Vendor states this is fixed in acc2a40e428f12780004e1e9fce4722d88f909fd (fixed)
Vendor states this is fixed in b8427b8522d9ede53015ba45a9978ba68d1162f5 (fixed)
Vendor states this is fixed in f31e18131ee2ce80a4da5c808221d25b1ae9ad6d (fixed)
Vendor states this is fixed in fb8e8d58f116d069e5939e1f786ac84e7fa4533e (fixed)
Vendor states this is fixed in 2.6.37 (unaffected)
Vendor states this is fixed in 4.14.316 (unaffected)
Vendor states this is fixed in 4.19.284 (unaffected)
Vendor states this is fixed in 5.10.181 (unaffected)
Vendor states this is fixed in 5.15.113 (unaffected)
Vendor states this is fixed in 5.4.244 (unaffected)
Vendor states this is fixed in 6.1.30 (unaffected)
Vendor states this is fixed in 6.3.4 (unaffected)
Vendor states this is fixed in 6.4 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card