PT-2025-53209 · Linux · Linux Kernel

Published 2023-04-16 · Updated 2026-01-28 · CVE-2023-54132

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.0-rc6-syzkaller-g09a9639e56c0

Description The Linux kernel contains a flaw related to the handling of erofs filesystem images. Specifically, the kernel does not properly validate the clusterofs value within the HEAD index of non-compact images. A crafted image with an invalid clusterofs value can trigger a page fault, leading to a kernel panic. This issue is triggered by Syzbot-generated images with a non-compact HEAD index and an invalid clusterofs value. Normal images or those using compact indexes are not affected. The vulnerable code is located within the z erofs decompress queue function.

Recommendations Update to Linux kernel version 6.3.0-rc6-syzkaller-g09a9639e56c0 or a later version to address this issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2026-04226

CVE-2023-54132

SUSE-SU-2026:0263-1

SUSE-SU-2026:0317-1

Affected Products

Linux Kernel

References · 860

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54132.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2023-54132 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0317-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-54132 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-54132 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04226 · Security Note
• https://ubuntu.com/security/CVE-2023-54132 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-54132 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-54132 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-54132 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-54132 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0263-1 · Vendor Advisory
• https://bugzilla.suse.com/1255996 · Note
• https://suse.com/security/cve/CVE-2023-54118 · Note
• https://bugzilla.suse.com/1255007 · Note