PT-2025-38459 · Linux+2 · Linux Kernel+2

Published 2025-09-18 · Updated 2025-10-23 · CVE-2023-53440

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The nilfs2 sysfs support in the Linux kernel has issues with the timing of creation and deletion of sysfs entries. This can lead to null pointer dereferences, use-after-free conditions, and lockdep warnings. Specifically, sysfs attributes for nilfs2 per-filesystem instances may refer to metadata files before their inodes are loaded, or be accessed after the metadata file inodes are released. Additionally, the creation of sysfs entries can occur during a semaphore lock, potentially causing lock dependencies and false positive lockdep warnings. The issue is resolved by revising when the device's sysfs interface is created and deleted, ensuring its lifetime is within the lifetime of the metadata files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Use After Free

Weakness Enumeration

CWE-476

CWE-416

Related Identifiers

BDU:2025-12411

CVE-2023-53440

SUSE-SU-2025:03615-1

SUSE-SU-2025:03628-1

SUSE-SU-2025:3716-1

SUSE-SU-2025:3761-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 868

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53440.json · Exploit
• https://git.kernel.org/stable/c/1942ccb7d95f287a312fcbabfa8bc9ba501b1953 · Patch
• https://git.kernel.org/stable/c/d20dcec8f326deb77b6688f8441e014045dac457 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-53440 · Security Note
• https://git.kernel.org/stable/c/d540aea451ab5489777a8156560f1388449b3109 · Patch
• https://git.kernel.org/stable/c/3dbee84bf9e3273c4bb9ca6fc18ff22fba23dd24 · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-53440 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53440 · Vendor Advisory
• https://git.kernel.org/stable/c/5fe0ea141fbb887d407f1bf572ebf24427480d5c · Patch
• https://git.kernel.org/stable/c/42560f9c92cc43dce75dbf06cc0d840dced39b12 · Patch
• https://git.kernel.org/stable/c/daf4eb3a908b108279b60172d2f176e70d2df875 · Patch
• https://git.kernel.org/stable/c/83b16a60e413148685739635901937e2f16a7873 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2023-53440 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3761-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-53440 · Vendor Advisory