Executive brief
The Linux kernel's ext4 filesystem failed to properly check for errors returned by the ext4_dirhash() function when processing directory entries with encrypted or case-folded filenames. An attacker could craft a malicious filesystem or exploit this through a local attack to trigger a kernel error, potentially causing a denial of service or system crash.
Technical details
CVE-2023-53473 is a missing error handling vulnerability in the ext4 filesystem driver (fs/ext4/hash.c and fs/ext4/namei.c). The ext4_dirhash() function can fail when processing encrypted or case-folded directory filenames, but multiple callers did not check the return value for errors. The vulnerability allows the function's error code to be silently ignored, leading to incorrect hash tree operations. The fix adds proper error checking and propagation in several call sites (dx_probe, htree_dirblock_to_tree, and dx_make_map), returning errors upward rather than continuing with invalid state. This is a local attack requiring filesystem access; patches are available in Linux kernel 5.10 and later stable versions.
Affected products
- Linux Linux Kernel 5.0 through 6.3 (and stable branches)
Timeline
- 2023-05-13: disclosed
- 2023-05-13: patched
- 2025-10-01: other: Published to NVD database