What’s Vulnerable › Vulnerabilities

CVE-2023-53285: ext4: add bounds checking in get_max_inline_xattr_value_size()

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-16 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: add bounds checking in get_max_inline_xattr_value_size() Normally the extended attributes in the inode body would have been checked when the inode is first opened, but if someone is writing to the block device while the file system is mounted, it's possible for the inode table to get corrupted. Add bounds checking to avoid reading beyond the end of allocated memory if this happens.

Affected products

• Linux kernel: before 4.14.315; from 4.15 before 4.19.283; from 4.20 before 5.4.243; from 5.5 before 5.10.180; from 5.11 before 5.15.112; from 5.16 before 6.1.29 — fixed in 4.14.315, 4.19.283, 5.10.180, 5.15.112, 5.4.243, 6.1.29

How to fix

Upgrade to a fixed version: Linux kernel 4.14.315, 4.19.283, 5.10.180, 5.15.112. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1d2caddbeeee56fbbc36b428c5b909c3ad88eb7f
• https://git.kernel.org/stable/c/2220eaf90992c11d888fe771055d4de330385f01
• https://git.kernel.org/stable/c/3d7b8fbcd2273e2b9f4c6de5ce2f4c0cd3cb1205
• https://git.kernel.org/stable/c/4597554b4f7b29e7fd78aa449bab648f8da4ee2c
• https://git.kernel.org/stable/c/486efbbc9445dca7890a1b86adbccb88b91284b0
• https://git.kernel.org/stable/c/5a229d21b98d132673096710e8281ef522dab1d1
• https://git.kernel.org/stable/c/88a06a94942c5c0a896e9da1113a6bb29e36cbef
• https://git.kernel.org/stable/c/e780058bd75614b66882bc02620ddbd884171560
• https://git.kernel.org/stable/c/f22b274429e88d3dc7e79d375b56ce4f2f59f0b4

Get alerted when CVE-2023-53285 or the next vulnerability affects your stack