CVE-2023-53503

ext4: allow ext4_get_group_info() to fail

published October 1, 2025

CVSS
—
EPSS
0%
Percentile
4.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ext4: allow ext4_get_group_info() to fail

Previously, ext4_get_group_info() would treat an invalid group number

as BUG(), since in theory it should never happen. However, if a

malicious attaker (or fuzzer) modifies the superblock via the block

device while it is the file system is mounted, it is possible for

s_first_data_block to get set to a very large number. In that case,

when calculating the block group of some block number (such as the

starting block of a preallocation region), could result in an

underflow and very large block group number. Then the BUG_ON check in

ext4_get_group_info() would fire, resutling in a denial of service

attack that can be triggered by root or someone with write access to

the block device.

For a quality of implementation perspective, it's best that even if

the system administrator does something that they shouldn't, that it

will not trigger a BUG. So instead of BUG'ing, ext4_get_group_info()

will call ext4_error and return NULL. We also add fallback code in

all of the callers of ext4_get_group_info() that it might NULL.

Also, since ext4_get_group_info() was already borderline to be an

inline function, un-inline it. The results in a next reduction of the

compiled text size of ext4 by roughly 2k.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00159 · 4.7th percentile
Published
2025-10-01T11:45Z
EPSS history
Timeline
  • 01 OCT 11:45Z
    ext4: allow ext4_get_group_info() to fail
    cvelistv5