What’s Vulnerable › Vulnerabilities

CVE-2023-53091: ext4: update s_journal_inum if it changes after journal replay

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-02 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: update s_journal_inum if it changes after journal replay When mounting a crafted ext4 image, s_journal_inum may change after journal replay, which is obviously unreasonable because we have successfully loaded and replayed the journal through the old s_journal_inum. And the new s_journal_inum bypasses some of the checks in ext4_get_journal(), which may trigger a null pointer dereference problem. So if s_journal_inum changes after the journal replay, we ignore the change, and rewrite the current journal_inum to the superblock.

Affected products

• Linux kernel: before 5.15.104; from 5.16 before 6.1.21; from 6.2 before 6.2.8 — fixed in 5.15.104, 6.1.21, 6.2.8

How to fix

Upgrade to a fixed version: Linux kernel 5.15.104, 6.1.21, 6.2.8. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/3039d8b8692408438a618fac2776b629852663c3
• https://git.kernel.org/stable/c/499fef2030fb754c68b1c7cb3a799a3bc1d0d925
• https://git.kernel.org/stable/c/70e66bdeae4d0f7c8e87762f425b68aedd5e8955
• https://git.kernel.org/stable/c/ee0c5277d4fab920bd31345c49e193ecede9ecef

Get alerted when CVE-2023-53091 or the next vulnerability affects your stack