GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53323 (GCVE-0-2023-53323)

Vulnerability from cvelistv5 – Published: 2025-09-16 16:11 – Updated: 2026-05-11 19:42
VLAI
Title
ext2/dax: Fix ext2_setsize when len is page aligned
Summary
In the Linux kernel, the following vulnerability has been resolved: ext2/dax: Fix ext2_setsize when len is page aligned PAGE_ALIGN(x) macro gives the next highest value which is multiple of pagesize. But if x is already page aligned then it simply returns x. So, if x passed is 0 in dax_zero_range() function, that means the length gets passed as 0 to ->iomap_begin(). In ext2 it then calls ext2_get_blocks -> max_blocks as 0 and hits bug_on here in ext2_get_blocks(). BUG_ON(maxblocks == 0); Instead we should be calling dax_truncate_page() here which takes care of it. i.e. it only calls dax_zero_range if the offset is not page/block aligned. This can be easily triggered with following on fsdax mounted pmem device. dd if=/dev/zero of=file count=1 bs=512 truncate -s 0 file [79.525838] EXT2-fs (pmem0): DAX enabled. Warning: EXPERIMENTAL, use at your own risk [79.529376] ext2 filesystem being mounted at /mnt1/test supports timestamps until 2038 (0x7fffffff) [93.793207] ------------[ cut here ]------------ [93.795102] kernel BUG at fs/ext2/inode.c:637! [93.796904] invalid opcode: 0000 [#1] PREEMPT SMP PTI [93.798659] CPU: 0 PID: 1192 Comm: truncate Not tainted 6.3.0-rc2-xfstests-00056-g131086faa369 #139 [93.806459] RIP: 0010:ext2_get_blocks.constprop.0+0x524/0x610 <...> [93.835298] Call Trace: [93.836253] <TASK> [93.837103] ? lock_acquire+0xf8/0x110 [93.838479] ? d_lookup+0x69/0xd0 [93.839779] ext2_iomap_begin+0xa7/0x1c0 [93.841154] iomap_iter+0xc7/0x150 [93.842425] dax_zero_range+0x6e/0xa0 [93.843813] ext2_setsize+0x176/0x1b0 [93.845164] ext2_setattr+0x151/0x200 [93.846467] notify_change+0x341/0x4e0 [93.847805] ? lock_acquire+0xf8/0x110 [93.849143] ? do_truncate+0x74/0xe0 [93.850452] ? do_truncate+0x84/0xe0 [93.851739] do_truncate+0x84/0xe0 [93.852974] do_sys_ftruncate+0x2b4/0x2f0 [93.854404] do_syscall_64+0x3f/0x90 [93.855789] entry_SYSCALL_64_after_hwframe+0x72/0xdc
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 18:28 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2aa3048e03d38d5358be2553d4b638c1a018498c , < 9e54fd14bd143c261e52fde74355e85e9526c58c (git)
Affected: 2aa3048e03d38d5358be2553d4b638c1a018498c , < 5cee8bfb8cbd99c97aff85d2bf066b6a496e13ab (git)
Affected: 2aa3048e03d38d5358be2553d4b638c1a018498c , < fcced95b6ba2a507a83b8b3e0358a8ac16b13e35 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.40 , ≤ 6.1.* (semver)
Unaffected: 6.4.5 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53323",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:28:00.441739Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-617",
                "description": "CWE-617 Reachable Assertion",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:32:58.758Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext2/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e54fd14bd143c261e52fde74355e85e9526c58c",
              "status": "affected",
              "version": "2aa3048e03d38d5358be2553d4b638c1a018498c",
              "versionType": "git"
            },
            {
              "lessThan": "5cee8bfb8cbd99c97aff85d2bf066b6a496e13ab",
              "status": "affected",
              "version": "2aa3048e03d38d5358be2553d4b638c1a018498c",
              "versionType": "git"
            },
            {
              "lessThan": "fcced95b6ba2a507a83b8b3e0358a8ac16b13e35",
              "status": "affected",
              "version": "2aa3048e03d38d5358be2553d4b638c1a018498c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext2/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.40",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next2/dax: Fix ext2_setsize when len is page aligned\n\nPAGE_ALIGN(x) macro gives the next highest value which is multiple of\npagesize. But if x is already page aligned then it simply returns x.\nSo, if x passed is 0 in dax_zero_range() function, that means the\nlength gets passed as 0 to -\u003eiomap_begin().\n\nIn ext2 it then calls ext2_get_blocks -\u003e max_blocks as 0 and hits bug_on\nhere in ext2_get_blocks().\n\tBUG_ON(maxblocks == 0);\n\nInstead we should be calling dax_truncate_page() here which takes\ncare of it. i.e. it only calls dax_zero_range if the offset is not\npage/block aligned.\n\nThis can be easily triggered with following on fsdax mounted pmem\ndevice.\n\ndd if=/dev/zero of=file count=1 bs=512\ntruncate -s 0 file\n\n[79.525838] EXT2-fs (pmem0): DAX enabled. Warning: EXPERIMENTAL, use at your own risk\n[79.529376] ext2 filesystem being mounted at /mnt1/test supports timestamps until 2038 (0x7fffffff)\n[93.793207] ------------[ cut here ]------------\n[93.795102] kernel BUG at fs/ext2/inode.c:637!\n[93.796904] invalid opcode: 0000 [#1] PREEMPT SMP PTI\n[93.798659] CPU: 0 PID: 1192 Comm: truncate Not tainted 6.3.0-rc2-xfstests-00056-g131086faa369 #139\n[93.806459] RIP: 0010:ext2_get_blocks.constprop.0+0x524/0x610\n\u003c...\u003e\n[93.835298] Call Trace:\n[93.836253]  \u003cTASK\u003e\n[93.837103]  ? lock_acquire+0xf8/0x110\n[93.838479]  ? d_lookup+0x69/0xd0\n[93.839779]  ext2_iomap_begin+0xa7/0x1c0\n[93.841154]  iomap_iter+0xc7/0x150\n[93.842425]  dax_zero_range+0x6e/0xa0\n[93.843813]  ext2_setsize+0x176/0x1b0\n[93.845164]  ext2_setattr+0x151/0x200\n[93.846467]  notify_change+0x341/0x4e0\n[93.847805]  ? lock_acquire+0xf8/0x110\n[93.849143]  ? do_truncate+0x74/0xe0\n[93.850452]  ? do_truncate+0x84/0xe0\n[93.851739]  do_truncate+0x84/0xe0\n[93.852974]  do_sys_ftruncate+0x2b4/0x2f0\n[93.854404]  do_syscall_64+0x3f/0x90\n[93.855789]  entry_SYSCALL_64_after_hwframe+0x72/0xdc"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:42:43.589Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9e54fd14bd143c261e52fde74355e85e9526c58c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5cee8bfb8cbd99c97aff85d2bf066b6a496e13ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcced95b6ba2a507a83b8b3e0358a8ac16b13e35"
        }
      ],
      "title": "ext2/dax: Fix ext2_setsize when len is page aligned",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53323",
    "datePublished": "2025-09-16T16:11:58.877Z",
    "dateReserved": "2025-09-16T16:08:59.563Z",
    "dateUpdated": "2026-05-11T19:42:43.589Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53323",
      "date": "2026-09-17",
      "epss": "0.00143",
      "percentile": "0.0399"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:56:46.000Z",
      "cve": "CVE-2023-53323",
      "id": "msrc_CVE-2023-53323",
      "initial_release_date": "2025-12-12T01:01:27.000Z",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ext2/dax: Fix ext2_setsize when len is page aligned",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2023-53323.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53323\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-16T17:15:38.410\",\"lastModified\":\"2026-06-17T06:44:53.353\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next2/dax: Fix ext2_setsize when len is page aligned\\n\\nPAGE_ALIGN(x) macro gives the next highest value which is multiple of\\npagesize. But if x is already page aligned then it simply returns x.\\nSo, if x passed is 0 in dax_zero_range() function, that means the\\nlength gets passed as 0 to -\u003eiomap_begin().\\n\\nIn ext2 it then calls ext2_get_blocks -\u003e max_blocks as 0 and hits bug_on\\nhere in ext2_get_blocks().\\n\\tBUG_ON(maxblocks == 0);\\n\\nInstead we should be calling dax_truncate_page() here which takes\\ncare of it. i.e. it only calls dax_zero_range if the offset is not\\npage/block aligned.\\n\\nThis can be easily triggered with following on fsdax mounted pmem\\ndevice.\\n\\ndd if=/dev/zero of=file count=1 bs=512\\ntruncate -s 0 file\\n\\n[79.525838] EXT2-fs (pmem0): DAX enabled. Warning: EXPERIMENTAL, use at your own risk\\n[79.529376] ext2 filesystem being mounted at /mnt1/test supports timestamps until 2038 (0x7fffffff)\\n[93.793207] ------------[ cut here ]------------\\n[93.795102] kernel BUG at fs/ext2/inode.c:637!\\n[93.796904] invalid opcode: 0000 [#1] PREEMPT SMP PTI\\n[93.798659] CPU: 0 PID: 1192 Comm: truncate Not tainted 6.3.0-rc2-xfstests-00056-g131086faa369 #139\\n[93.806459] RIP: 0010:ext2_get_blocks.constprop.0+0x524/0x610\\n\u003c...\u003e\\n[93.835298] Call Trace:\\n[93.836253]  \u003cTASK\u003e\\n[93.837103]  ? lock_acquire+0xf8/0x110\\n[93.838479]  ? d_lookup+0x69/0xd0\\n[93.839779]  ext2_iomap_begin+0xa7/0x1c0\\n[93.841154]  iomap_iter+0xc7/0x150\\n[93.842425]  dax_zero_range+0x6e/0xa0\\n[93.843813]  ext2_setsize+0x176/0x1b0\\n[93.845164]  ext2_setattr+0x151/0x200\\n[93.846467]  notify_change+0x341/0x4e0\\n[93.847805]  ? lock_acquire+0xf8/0x110\\n[93.849143]  ? do_truncate+0x74/0xe0\\n[93.850452]  ? do_truncate+0x84/0xe0\\n[93.851739]  do_truncate+0x84/0xe0\\n[93.852974]  do_sys_ftruncate+0x2b4/0x2f0\\n[93.854404]  do_syscall_64+0x3f/0x90\\n[93.855789]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ext2/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2aa3048e03d38d5358be2553d4b638c1a018498c\",\"lessThan\":\"9e54fd14bd143c261e52fde74355e85e9526c58c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2aa3048e03d38d5358be2553d4b638c1a018498c\",\"lessThan\":\"5cee8bfb8cbd99c97aff85d2bf066b6a496e13ab\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2aa3048e03d38d5358be2553d4b638c1a018498c\",\"lessThan\":\"fcced95b6ba2a507a83b8b3e0358a8ac16b13e35\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ext2/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.40\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.5\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T18:28:00.441739Z\",\"id\":\"CVE-2023-53323\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-617\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-617\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"6.1.40\",\"matchCriteriaId\":\"14E29848-70F0-48B5-AAE3-31AF00C2FC8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.4.5\",\"matchCriteriaId\":\"923F6AEA-C2EF-4B08-B038-69A18F3D41F8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5cee8bfb8cbd99c97aff85d2bf066b6a496e13ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e54fd14bd143c261e52fde74355e85e9526c58c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fcced95b6ba2a507a83b8b3e0358a8ac16b13e35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T22:17:41+00:00",
      "cve": "CVE-2023-53323",
      "id": "CVE-2023-53323",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext2/dax: Fix ext2_setsize when len is page aligned",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53323.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-53323\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T18:28:00.441739Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-617\", \"description\": \"CWE-617 Reachable Assertion\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T18:27:56.378Z\"}}], \"cna\": {\"title\": \"ext2/dax: Fix ext2_setsize when len is page aligned\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2aa3048e03d38d5358be2553d4b638c1a018498c\", \"lessThan\": \"9e54fd14bd143c261e52fde74355e85e9526c58c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2aa3048e03d38d5358be2553d4b638c1a018498c\", \"lessThan\": \"5cee8bfb8cbd99c97aff85d2bf066b6a496e13ab\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2aa3048e03d38d5358be2553d4b638c1a018498c\", \"lessThan\": \"fcced95b6ba2a507a83b8b3e0358a8ac16b13e35\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ext2/inode.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.40\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.4.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.4.*\"}, {\"status\": \"unaffected\", \"version\": \"6.5\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ext2/inode.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9e54fd14bd143c261e52fde74355e85e9526c58c\"}, {\"url\": \"https://git.kernel.org/stable/c/5cee8bfb8cbd99c97aff85d2bf066b6a496e13ab\"}, {\"url\": \"https://git.kernel.org/stable/c/fcced95b6ba2a507a83b8b3e0358a8ac16b13e35\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next2/dax: Fix ext2_setsize when len is page aligned\\n\\nPAGE_ALIGN(x) macro gives the next highest value which is multiple of\\npagesize. But if x is already page aligned then it simply returns x.\\nSo, if x passed is 0 in dax_zero_range() function, that means the\\nlength gets passed as 0 to -\u003eiomap_begin().\\n\\nIn ext2 it then calls ext2_get_blocks -\u003e max_blocks as 0 and hits bug_on\\nhere in ext2_get_blocks().\\n\\tBUG_ON(maxblocks == 0);\\n\\nInstead we should be calling dax_truncate_page() here which takes\\ncare of it. i.e. it only calls dax_zero_range if the offset is not\\npage/block aligned.\\n\\nThis can be easily triggered with following on fsdax mounted pmem\\ndevice.\\n\\ndd if=/dev/zero of=file count=1 bs=512\\ntruncate -s 0 file\\n\\n[79.525838] EXT2-fs (pmem0): DAX enabled. Warning: EXPERIMENTAL, use at your own risk\\n[79.529376] ext2 filesystem being mounted at /mnt1/test supports timestamps until 2038 (0x7fffffff)\\n[93.793207] ------------[ cut here ]------------\\n[93.795102] kernel BUG at fs/ext2/inode.c:637!\\n[93.796904] invalid opcode: 0000 [#1] PREEMPT SMP PTI\\n[93.798659] CPU: 0 PID: 1192 Comm: truncate Not tainted 6.3.0-rc2-xfstests-00056-g131086faa369 #139\\n[93.806459] RIP: 0010:ext2_get_blocks.constprop.0+0x524/0x610\\n\u003c...\u003e\\n[93.835298] Call Trace:\\n[93.836253]  \u003cTASK\u003e\\n[93.837103]  ? lock_acquire+0xf8/0x110\\n[93.838479]  ? d_lookup+0x69/0xd0\\n[93.839779]  ext2_iomap_begin+0xa7/0x1c0\\n[93.841154]  iomap_iter+0xc7/0x150\\n[93.842425]  dax_zero_range+0x6e/0xa0\\n[93.843813]  ext2_setsize+0x176/0x1b0\\n[93.845164]  ext2_setattr+0x151/0x200\\n[93.846467]  notify_change+0x341/0x4e0\\n[93.847805]  ? lock_acquire+0xf8/0x110\\n[93.849143]  ? do_truncate+0x74/0xe0\\n[93.850452]  ? do_truncate+0x84/0xe0\\n[93.851739]  do_truncate+0x84/0xe0\\n[93.852974]  do_sys_ftruncate+0x2b4/0x2f0\\n[93.854404]  do_syscall_64+0x3f/0x90\\n[93.855789]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.40\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.4.5\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.5\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-09-16T16:11:58.877Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-53323\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-14T18:32:58.758Z\", \"dateReserved\": \"2025-09-16T16:08:59.563Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-16T16:11:58.877Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.