CVE-2023-54062

A memory management flaw was found in the Linux kernel's ext4 filesystem extended attribute handling. In ext4_xattr_move_to_block(), when moving an extended attribute value to an external block, the code checks entry->e_value_inum to determine if the buffer was allocated via kvmalloc(). However, at cleanup time the xattr entry pointer is stale (already removed), leading to either calling kvfree() on an invalid pointer or leaking memory that should have been freed.

This flaw affects ext4 filesystems using extended attributes stored in external inodes. The invalid free tracking occurs when moving large xattr values to separate blocks. While this can cause memory corruption or leaks, exploiting it requires specific filesystem operations on ext4 with large extended attributes, limiting practical attack scenarios.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.