CVE-2023-53486 (GCVE-0-2023-53486)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:42 – Updated: 2026-08-05 09:14
VLAI
Title
fs/ntfs3: Enhance the attribute size check
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Enhance the attribute size check This combines the overflow and boundary check so that all attribute size will be properly examined while enumerating them. [ 169.181521] BUG: KASAN: slab-out-of-bounds in run_unpack+0x2e3/0x570 [ 169.183161] Read of size 1 at addr ffff8880094b6240 by task mount/247 [ 169.184046] [ 169.184925] CPU: 0 PID: 247 Comm: mount Not tainted 6.0.0-rc7+ #3 [ 169.185908] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 169.187066] Call Trace: [ 169.187492] <TASK> [ 169.188049] dump_stack_lvl+0x49/0x63 [ 169.188495] print_report.cold+0xf5/0x689 [ 169.188964] ? run_unpack+0x2e3/0x570 [ 169.189331] kasan_report+0xa7/0x130 [ 169.189714] ? run_unpack+0x2e3/0x570 [ 169.190079] __asan_load1+0x51/0x60 [ 169.190634] run_unpack+0x2e3/0x570 [ 169.191290] ? run_pack+0x840/0x840 [ 169.191569] ? run_lookup_entry+0xb3/0x1f0 [ 169.192443] ? mi_enum_attr+0x20a/0x230 [ 169.192886] run_unpack_ex+0xad/0x3e0 [ 169.193276] ? run_unpack+0x570/0x570 [ 169.193557] ? ni_load_mi+0x80/0x80 [ 169.193889] ? debug_smp_processor_id+0x17/0x20 [ 169.194236] ? mi_init+0x4a/0x70 [ 169.194496] attr_load_runs_vcn+0x166/0x1c0 [ 169.194851] ? attr_data_write_resident+0x250/0x250 [ 169.195188] mi_read+0x133/0x2c0 [ 169.195481] ntfs_iget5+0x277/0x1780 [ 169.196017] ? call_rcu+0x1c7/0x330 [ 169.196392] ? ntfs_get_block_bmap+0x70/0x70 [ 169.196708] ? evict+0x223/0x280 [ 169.197014] ? __kmalloc+0x33/0x540 [ 169.197305] ? wnd_init+0x15b/0x1b0 [ 169.197599] ntfs_fill_super+0x1026/0x1ba0 [ 169.197994] ? put_ntfs+0x1d0/0x1d0 [ 169.198299] ? vsprintf+0x20/0x20 [ 169.198583] ? mutex_unlock+0x81/0xd0 [ 169.198930] ? set_blocksize+0x95/0x150 [ 169.199269] get_tree_bdev+0x232/0x370 [ 169.199750] ? put_ntfs+0x1d0/0x1d0 [ 169.200094] ntfs_fs_get_tree+0x15/0x20 [ 169.200431] vfs_get_tree+0x4c/0x130 [ 169.200714] path_mount+0x654/0xfe0 [ 169.201067] ? putname+0x80/0xa0 [ 169.201358] ? finish_automount+0x2e0/0x2e0 [ 169.201965] ? putname+0x80/0xa0 [ 169.202445] ? kmem_cache_free+0x1c4/0x440 [ 169.203075] ? putname+0x80/0xa0 [ 169.203414] do_mount+0xd6/0xf0 [ 169.203719] ? path_mount+0xfe0/0xfe0 [ 169.203977] ? __kasan_check_write+0x14/0x20 [ 169.204382] __x64_sys_mount+0xca/0x110 [ 169.204711] do_syscall_64+0x3b/0x90 [ 169.205059] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 169.205571] RIP: 0033:0x7f67a80e948a [ 169.206327] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008 [ 169.208296] RSP: 002b:00007ffddf020f58 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 169.209253] RAX: ffffffffffffffda RBX: 000055e2547a6060 RCX: 00007f67a80e948a [ 169.209777] RDX: 000055e2547a6260 RSI: 000055e2547a62e0 RDI: 000055e2547aeaf0 [ 169.210342] RBP: 0000000000000000 R08: 000055e2547a6280 R09: 0000000000000020 [ 169.210843] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 000055e2547aeaf0 [ 169.211307] R13: 000055e2547a6260 R14: 0000000000000000 R15: 00000000ffffffff [ 169.211913] </TASK> [ 169.212304] [ 169.212680] Allocated by task 0: [ 169.212963] (stack is not available) [ 169.213200] [ 169.213472] The buggy address belongs to the object at ffff8880094b5e00 [ 169.213472] which belongs to the cache UDP of size 1152 [ 169.214095] The buggy address is located 1088 bytes inside of [ 169.214095] 1152-byte region [ffff8880094b5e00, ffff8880094b6280) [ 169.214639] [ 169.215004] The buggy address belongs to the physical page: [ 169.215766] page:000000002e324c8c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x94b4 [ 169.218412] head:000000002e324c8c order:2 compound_mapcount:0 compound_pincount:0 [ 169.219078] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 169.220272] raw: 000fffffc0010200 ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < 1fd5b80c9339503f3eaa4db3051b37ac506beeab (git)
Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < 277439e7cabd9d4c6334b39a4b99d49b4c97265b (git)
Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < f28d9e02c2c242e8f9af9e13ba263fcc0211be49 (git)
Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < 4f082a7531223a438c757bb20e304f4c941c67a8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.113 , ≤ 5.15.* (semver)
Unaffected: 6.1.80 , ≤ 6.1.* (semver)
Unaffected: 6.3.4 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/record.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1fd5b80c9339503f3eaa4db3051b37ac506beeab",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            },
            {
              "lessThan": "277439e7cabd9d4c6334b39a4b99d49b4c97265b",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            },
            {
              "lessThan": "f28d9e02c2c242e8f9af9e13ba263fcc0211be49",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            },
            {
              "lessThan": "4f082a7531223a438c757bb20e304f4c941c67a8",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/record.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.80",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Enhance the attribute size check\n\nThis combines the overflow and boundary check so that all attribute size\nwill be properly examined while enumerating them.\n\n[  169.181521] BUG: KASAN: slab-out-of-bounds in run_unpack+0x2e3/0x570\n[  169.183161] Read of size 1 at addr ffff8880094b6240 by task mount/247\n[  169.184046]\n[  169.184925] CPU: 0 PID: 247 Comm: mount Not tainted 6.0.0-rc7+ #3\n[  169.185908] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[  169.187066] Call Trace:\n[  169.187492]  \u003cTASK\u003e\n[  169.188049]  dump_stack_lvl+0x49/0x63\n[  169.188495]  print_report.cold+0xf5/0x689\n[  169.188964]  ? run_unpack+0x2e3/0x570\n[  169.189331]  kasan_report+0xa7/0x130\n[  169.189714]  ? run_unpack+0x2e3/0x570\n[  169.190079]  __asan_load1+0x51/0x60\n[  169.190634]  run_unpack+0x2e3/0x570\n[  169.191290]  ? run_pack+0x840/0x840\n[  169.191569]  ? run_lookup_entry+0xb3/0x1f0\n[  169.192443]  ? mi_enum_attr+0x20a/0x230\n[  169.192886]  run_unpack_ex+0xad/0x3e0\n[  169.193276]  ? run_unpack+0x570/0x570\n[  169.193557]  ? ni_load_mi+0x80/0x80\n[  169.193889]  ? debug_smp_processor_id+0x17/0x20\n[  169.194236]  ? mi_init+0x4a/0x70\n[  169.194496]  attr_load_runs_vcn+0x166/0x1c0\n[  169.194851]  ? attr_data_write_resident+0x250/0x250\n[  169.195188]  mi_read+0x133/0x2c0\n[  169.195481]  ntfs_iget5+0x277/0x1780\n[  169.196017]  ? call_rcu+0x1c7/0x330\n[  169.196392]  ? ntfs_get_block_bmap+0x70/0x70\n[  169.196708]  ? evict+0x223/0x280\n[  169.197014]  ? __kmalloc+0x33/0x540\n[  169.197305]  ? wnd_init+0x15b/0x1b0\n[  169.197599]  ntfs_fill_super+0x1026/0x1ba0\n[  169.197994]  ? put_ntfs+0x1d0/0x1d0\n[  169.198299]  ? vsprintf+0x20/0x20\n[  169.198583]  ? mutex_unlock+0x81/0xd0\n[  169.198930]  ? set_blocksize+0x95/0x150\n[  169.199269]  get_tree_bdev+0x232/0x370\n[  169.199750]  ? put_ntfs+0x1d0/0x1d0\n[  169.200094]  ntfs_fs_get_tree+0x15/0x20\n[  169.200431]  vfs_get_tree+0x4c/0x130\n[  169.200714]  path_mount+0x654/0xfe0\n[  169.201067]  ? putname+0x80/0xa0\n[  169.201358]  ? finish_automount+0x2e0/0x2e0\n[  169.201965]  ? putname+0x80/0xa0\n[  169.202445]  ? kmem_cache_free+0x1c4/0x440\n[  169.203075]  ? putname+0x80/0xa0\n[  169.203414]  do_mount+0xd6/0xf0\n[  169.203719]  ? path_mount+0xfe0/0xfe0\n[  169.203977]  ? __kasan_check_write+0x14/0x20\n[  169.204382]  __x64_sys_mount+0xca/0x110\n[  169.204711]  do_syscall_64+0x3b/0x90\n[  169.205059]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  169.205571] RIP: 0033:0x7f67a80e948a\n[  169.206327] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008\n[  169.208296] RSP: 002b:00007ffddf020f58 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5\n[  169.209253] RAX: ffffffffffffffda RBX: 000055e2547a6060 RCX: 00007f67a80e948a\n[  169.209777] RDX: 000055e2547a6260 RSI: 000055e2547a62e0 RDI: 000055e2547aeaf0\n[  169.210342] RBP: 0000000000000000 R08: 000055e2547a6280 R09: 0000000000000020\n[  169.210843] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 000055e2547aeaf0\n[  169.211307] R13: 000055e2547a6260 R14: 0000000000000000 R15: 00000000ffffffff\n[  169.211913]  \u003c/TASK\u003e\n[  169.212304]\n[  169.212680] Allocated by task 0:\n[  169.212963] (stack is not available)\n[  169.213200]\n[  169.213472] The buggy address belongs to the object at ffff8880094b5e00\n[  169.213472]  which belongs to the cache UDP of size 1152\n[  169.214095] The buggy address is located 1088 bytes inside of\n[  169.214095]  1152-byte region [ffff8880094b5e00, ffff8880094b6280)\n[  169.214639]\n[  169.215004] The buggy address belongs to the physical page:\n[  169.215766] page:000000002e324c8c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x94b4\n[  169.218412] head:000000002e324c8c order:2 compound_mapcount:0 compound_pincount:0\n[  169.219078] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)\n[  169.220272] raw: 000fffffc0010200\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - ntfs3 is a block-device filesystem (`FS_REQUIRES_DEV`); the attack requires a crafted NTFS image on a local block device, loop file, or removable medium and is triggered via mount(2)/inode lookup. No network protocol is involved.\nAC:L - The attacker fully controls `attr-\u003esize` in the image, and any value \u003e= 0x100000000 - off deterministically wraps the `off + asize \u003e used` check; there is no race and no dependence on memory layout to reach the out-of-bounds access.\nPR:L - ntfs3 lacks FS_USERNS_MOUNT, but on the realistic desktop/kiosk/embedded/automotive deployments an unprivileged console user can mount attacker-supplied NTFS removable media through udisks2/policykit automount or an fstab `user` entry, so basic local user privileges suffice.\nUI:N - The attacker performs the mount themselves, or the crafted volume is automounted on insertion; no separate victim action is required, and on an already-mounted hostile image any inode lookup re-enters `mi_enum_attr()`.\nS:U - The corruption is confined to kernel slab memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The bogus ~4 GB `asize` neutralizes the resident-data checks, letting `ntfs_load_attr_list()` memcpy an attacker-chosen `data_size` out of a ~1 KB record buffer, and `run_unpack()` read past the slab (KASAN caught it landing in a neighbouring UDP socket object) \u2014 a large kernel heap disclosure whose contents are reflected into parsed structures and back to the image.\nI:H - `mi_resize_attr()`/`mi_remove_attr()` use `Add2Ptr(attr, asize)` with a wrapped-positive `tail`, producing out-of-bounds memmove/memset writes through a wild pointer, and runlists synthesized from out-of-bounds heap bytes redirect file data to arbitrary volume clusters.\nA:H - The commit documents a KASAN slab-out-of-bounds oops at mount time, and the unbounded reads plus wild-pointer writes readily fault into unmapped memory, causing a kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:21.111Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1fd5b80c9339503f3eaa4db3051b37ac506beeab"
        },
        {
          "url": "https://git.kernel.org/stable/c/277439e7cabd9d4c6334b39a4b99d49b4c97265b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f28d9e02c2c242e8f9af9e13ba263fcc0211be49"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f082a7531223a438c757bb20e304f4c941c67a8"
        }
      ],
      "title": "fs/ntfs3: Enhance the attribute size check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53486",
    "datePublished": "2025-10-01T11:42:54.028Z",
    "dateReserved": "2025-10-01T11:39:39.402Z",
    "dateUpdated": "2026-08-05T09:14:21.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53486",
      "date": "2026-09-27",
      "epss": "0.00164",
      "percentile": "0.04967"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/record.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1fd5b80c9339503f3eaa4db3051b37ac506beeab",
                    "status": "affected",
                    "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "277439e7cabd9d4c6334b39a4b99d49b4c97265b",
                    "status": "affected",
                    "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f28d9e02c2c242e8f9af9e13ba263fcc0211be49",
                    "status": "affected",
                    "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4f082a7531223a438c757bb20e304f4c941c67a8",
                    "status": "affected",
                    "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/record.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.80",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "75B3BF61-F56C-4BD7-94AF-50E17A4AA732",
                    "versionEndExcluding": "5.15.113",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BA7850CE-97C9-4408-A348-6173296BCA2B",
                    "versionEndExcluding": "6.1.80",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26C54BF0-3EED-46D4-92A7-5F07F658B49B",
                    "versionEndExcluding": "6.3.4",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Enhance the attribute size check\n\nThis combines the overflow and boundary check so that all attribute size\nwill be properly examined while enumerating them.\n\n[  169.181521] BUG: KASAN: slab-out-of-bounds in run_unpack+0x2e3/0x570\n[  169.183161] Read of size 1 at addr ffff8880094b6240 by task mount/247\n[  169.184046]\n[  169.184925] CPU: 0 PID: 247 Comm: mount Not tainted 6.0.0-rc7+ #3\n[  169.185908] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[  169.187066] Call Trace:\n[  169.187492]  \u003cTASK\u003e\n[  169.188049]  dump_stack_lvl+0x49/0x63\n[  169.188495]  print_report.cold+0xf5/0x689\n[  169.188964]  ? run_unpack+0x2e3/0x570\n[  169.189331]  kasan_report+0xa7/0x130\n[  169.189714]  ? run_unpack+0x2e3/0x570\n[  169.190079]  __asan_load1+0x51/0x60\n[  169.190634]  run_unpack+0x2e3/0x570\n[  169.191290]  ? run_pack+0x840/0x840\n[  169.191569]  ? run_lookup_entry+0xb3/0x1f0\n[  169.192443]  ? mi_enum_attr+0x20a/0x230\n[  169.192886]  run_unpack_ex+0xad/0x3e0\n[  169.193276]  ? run_unpack+0x570/0x570\n[  169.193557]  ? ni_load_mi+0x80/0x80\n[  169.193889]  ? debug_smp_processor_id+0x17/0x20\n[  169.194236]  ? mi_init+0x4a/0x70\n[  169.194496]  attr_load_runs_vcn+0x166/0x1c0\n[  169.194851]  ? attr_data_write_resident+0x250/0x250\n[  169.195188]  mi_read+0x133/0x2c0\n[  169.195481]  ntfs_iget5+0x277/0x1780\n[  169.196017]  ? call_rcu+0x1c7/0x330\n[  169.196392]  ? ntfs_get_block_bmap+0x70/0x70\n[  169.196708]  ? evict+0x223/0x280\n[  169.197014]  ? __kmalloc+0x33/0x540\n[  169.197305]  ? wnd_init+0x15b/0x1b0\n[  169.197599]  ntfs_fill_super+0x1026/0x1ba0\n[  169.197994]  ? put_ntfs+0x1d0/0x1d0\n[  169.198299]  ? vsprintf+0x20/0x20\n[  169.198583]  ? mutex_unlock+0x81/0xd0\n[  169.198930]  ? set_blocksize+0x95/0x150\n[  169.199269]  get_tree_bdev+0x232/0x370\n[  169.199750]  ? put_ntfs+0x1d0/0x1d0\n[  169.200094]  ntfs_fs_get_tree+0x15/0x20\n[  169.200431]  vfs_get_tree+0x4c/0x130\n[  169.200714]  path_mount+0x654/0xfe0\n[  169.201067]  ? putname+0x80/0xa0\n[  169.201358]  ? finish_automount+0x2e0/0x2e0\n[  169.201965]  ? putname+0x80/0xa0\n[  169.202445]  ? kmem_cache_free+0x1c4/0x440\n[  169.203075]  ? putname+0x80/0xa0\n[  169.203414]  do_mount+0xd6/0xf0\n[  169.203719]  ? path_mount+0xfe0/0xfe0\n[  169.203977]  ? __kasan_check_write+0x14/0x20\n[  169.204382]  __x64_sys_mount+0xca/0x110\n[  169.204711]  do_syscall_64+0x3b/0x90\n[  169.205059]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  169.205571] RIP: 0033:0x7f67a80e948a\n[  169.206327] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008\n[  169.208296] RSP: 002b:00007ffddf020f58 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5\n[  169.209253] RAX: ffffffffffffffda RBX: 000055e2547a6060 RCX: 00007f67a80e948a\n[  169.209777] RDX: 000055e2547a6260 RSI: 000055e2547a62e0 RDI: 000055e2547aeaf0\n[  169.210342] RBP: 0000000000000000 R08: 000055e2547a6280 R09: 0000000000000020\n[  169.210843] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 000055e2547aeaf0\n[  169.211307] R13: 000055e2547a6260 R14: 0000000000000000 R15: 00000000ffffffff\n[  169.211913]  \u003c/TASK\u003e\n[  169.212304]\n[  169.212680] Allocated by task 0:\n[  169.212963] (stack is not available)\n[  169.213200]\n[  169.213472] The buggy address belongs to the object at ffff8880094b5e00\n[  169.213472]  which belongs to the cache UDP of size 1152\n[  169.214095] The buggy address is located 1088 bytes inside of\n[  169.214095]  1152-byte region [ffff8880094b5e00, ffff8880094b6280)\n[  169.214639]\n[  169.215004] The buggy address belongs to the physical page:\n[  169.215766] page:000000002e324c8c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x94b4\n[  169.218412] head:000000002e324c8c order:2 compound_mapcount:0 compound_pincount:0\n[  169.219078] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)\n[  169.220272] raw: 000fffffc0010200\n---truncated---"
          }
        ],
        "id": "CVE-2023-53486",
        "lastModified": "2026-08-04T10:19:08.583",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-10-01T12:15:51.480",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1fd5b80c9339503f3eaa4db3051b37ac506beeab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/277439e7cabd9d4c6334b39a4b99d49b4c97265b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4f082a7531223a438c757bb20e304f4c941c67a8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f28d9e02c2c242e8f9af9e13ba263fcc0211be49"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:17:12+00:00",
      "cve": "CVE-2023-53486",
      "id": "CVE-2023-53486",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/ntfs3: Enhance the attribute size check",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53486.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:07:07Z",
      "cve": "CVE-2023-53486",
      "id": "CVE-2023-53486",
      "initial_release_date": "2025-10-01T23:30:20Z",
      "product_status:known_not_affected": "523",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53486",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53486.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.