PT-2025-49493 · Linux+1 · Linux Kernel+1

Published 2025-12-08 · Updated 2025-12-09 · CVE-2023-53763

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contained a flaw related to the f2fs filesystem. A regression was introduced by a previous fix intended to improve sanity checks on the extent cache. The issue manifested as an out-of-bounds array access within the f2fs.h file, specifically at line 3275, when handling extent cache data. The problem was identified by the syzbot fuzzer, which reported a UBSAN error indicating an invalid index access. The root cause was the application of both version 1 and version 2 of a patch, where version 2 was the correct fix, necessitating the reversion of version 1 to resolve the reported issue. The vulnerable code is located within the recover inline status function called from do read inode and f2fs iget.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-53763

Affected Products

Linux Kernel

F2Fs

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53763.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-53763 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53763 · Security Note
• https://ubuntu.com/security/CVE-2023-53763 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53763 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53763 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-53763 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53763 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-53763 · Vendor Advisory
• https://git.kernel.org/linus/958ccbbf1ce716d77c7cfa79ace50a421c1eed73 · Note
• https://git.kernel.org/stable/c/958ccbbf1ce716d77c7cfa79ace50a421c1eed73 · Note
• https://twitter.com/CVEnew/status/1997863648488726655 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/stable/c/0d545a8e77cbd1fbad311b18952e38e0f7672ab4 · Note
• https://t.me/CVEtracker/39072 · Telegram Post