Executive brief
The Linux ext4 filesystem has a memory management bug in extended attribute handling that can lead to incorrect memory freeing or leaks. When moving extended attribute values to external blocks, the kernel may attempt to free memory that was never allocated or fail to free memory that should be freed, potentially causing system instability or data corruption on systems using ext4 filesystems.
Technical details
The vulnerability is a use-after-free / double-free issue in the ext4_xattr_move_to_block() function. The function attempts to check if a buffer was allocated via kvmalloc() by testing entry->e_value_inum at cleanup time, but the pointer to the xattr entry is no longer valid at that point (it was already removed from its original location). This results in either calling kvfree() on a non-kvmalloc'd pointer or failing to free kvmalloc'd memory. The fix introduces a separate boolean flag to track whether kvfree() should be called, set at the point where kvmalloc() is actually invoked. No user interaction or special privileges are required; the bug can be triggered through normal filesystem operations on ext4.
Affected products
- Linux Linux kernel Multiple versions (patched in 5.15.4, 5.16.1, 6.0.1 and later)
Timeline
- 2023-04-30: disclosed: Patch committed by Theodore Ts'o
- 2023-05-17: patched: Stable tree updates
- 2025-12-24: other: CVE-2023-54062 assigned