CVE-2023-53692

A flaw was discovered in the ext4 filesystem implementation in the Linux kernel. When a filesystem is created or used with both the bigalloc and inline data features enabled, under specific conditions, the function ext4_find_extent() may execute a use-after-free read (because inline data was converted to an extent but the flag wasn’t set). This can lead to memory corruption or instability when writing to files on the ext4 filesystem.

A use-after-free read flaw was found in the Linux kernel's ext4 filesystem implementation. On a filesystem mounted with both the bigalloc and inline data features enabled, a local user with write access to files can, under specific delayed-allocation conditions where inline data has been converted to an extent, trigger a use-after-free read in ext4_find_extent(), potentially causing memory corruption, instability, or a kernel panic. Red Hat rated this flaw Moderate severity because it impacts system availability but has no demonstrated confidentiality or integrity impact; this differs from the upstream CVE.org score of 7.8, which assumes high confidentiality and integrity impacts that Red Hat's analysis does not support for this read-only use-after-free path. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt versions listed in this flaw are marked not affected because the vulnerable code is not present in those shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.