CVE-2023-53692

HIGHPre-NVD 7.87.8—
EchelonGraph scoreMEDIUM confidence

Score 7.8 from GitHub Security Advisory (severity: HIGH) published 2025-10-22. the CNA's CVSS baseline 7.8; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: cna:linux, epss, ghsa
Trending — 4 sources updated this week
7.8EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 7.8Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline

Syzbot found the following issue: loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. ================================================================== BUG: KASAN: use-after-free in ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] BUG: KASAN: use-after-free in ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931 Read of size 4 at addr ffff888073644750 by task syz-executor420/5067

CPU: 0 PID: 5067 Comm: syz-executor420 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931 ext4_clu_mapped+0x117/0x970 fs/ext4/extents.c:5809 ext4_insert_delayed_block fs/ext4/inode.c:1696 [inline] ext4_da_map_blocks fs/ext4/inode.c:1806 [inline] ext4_da_get_block_prep+0x9e8/0x13c0 fs/ext4/inode.c:1870 ext4_block_write_begin+0x6a8/0x2290 fs/ext4/inode.c:1098 ext4_da_write_begin+0x539/0x760 fs/ext4/inode.c:3082 generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772 ext4_buffered_write_iter+0x122/0x3a0 fs/ext4/file.c:285 ext4_file_write_iter+0x1d0/0x18f0 call_write_iter include/linux/fs.h:2186 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f4b7a9737b9 RSP: 002b:00007ffc5cac3668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4b7a9737b9 RDX: 00000000175d9003 RSI: 0000000020000200 RDI: 0000000000000004 RBP: 00007f4b7a933050 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000079f R11: 0000000000000246 R12: 00007f4b7a9330e0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Above issue is happens when enable bigalloc and inline data feature. As commit 131294c35ed6 fixed delayed allocation bug in ext4_clu_mapped for bigalloc + inline. But it only resolved issue when has inline data, if inline data has been converted to extent(ext4_da_convert_inline_data_to_extent) before writepages, there is no EXT4_STATE_MAY_INLINE_DATA flag. However i_data is still store inline data in this scene. Then will trigger UAF when find extent. To resolve above issue, there is need to add judge "ext4_has_inline_data(inode)" in ext4_clu_mapped().

CVSS v3
7.8
EG Score
7.8(medium)
EG Risk
40(Track)
EG Risk 40/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity78% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
5%
KEV
Not listed

Published

October 22, 2025

Last Modified

August 5, 2026

Advisory Details (8)

Auto-updated Aug 5, 2026
No patch confirmed yet.
generic

ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/835659598c67907b98cd2aa57bb951dfaf675c69
generic

ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/14da044725a3ab10affa3566d29c15737c0e67a4
generic

ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/11c87c8df2cae1d6be83c07e59fef0792de73482
generic

ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/96d440bee177669dc0acedca0abd73bae6a9be8b
generic

ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/40566def189c513be2c694681256d7486cc6e368
generic

ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/770b0613637f59f3091dda1ff0c23671a5326b9c
generic

ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/a34f6dcb78c654ab905642c1b4e7e5fbb4f0babe
generic

Revert "ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline" - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/0ce15000dee0ecd6f235f925a327803e2ef489c6

Vendor Advisories for CVE-2023-53692(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Patch Availability(1)

Vendor / EcosystemFixed in / PatchReleasedSource
linuxKernel @ 4.19.271—osv

Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.

Data Freshness Timeline

(refreshed 15× in last 7d / 48× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

Showing the most recent 100 of 136 total refreshes for this CVE.

  1. 2026-08-05 19:15 UTCEPSS rescore
  2. 2026-08-05 19:15 UTCEPSS rescore
  3. 2026-08-05 10:16 UTCEG score recompute
  4. 2026-08-05 10:16 UTCGHSA enrichment
  5. 2026-08-04 10:56 UTCEG score recompute
  6. 2026-08-04 10:56 UTCGHSA enrichment
  7. 2026-08-04 10:36 UTCEPSS rescore
  8. 2026-08-04 09:27 UTCEG score recompute▲ 7.80
  9. 2026-08-04 09:27 UTCGHSA enrichment
  10. 2026-08-04 09:20 UTCMITRE cvelistV5CVSS v3 → 7.8 · severity → HIGH
  11. 2026-08-03 10:34 UTCEPSS rescore
  12. 2026-08-02 02:25 UTCEPSS rescore
  13. 2026-08-02 02:25 UTCEPSS rescore
  14. 2026-08-01 04:14 UTCEPSS rescore
  15. 2026-07-30 16:26 UTCEPSS rescore
  16. 2026-07-30 01:29 UTCEPSS rescore
  17. 2026-07-28 15:34 UTCEPSS rescore
  18. 2026-07-28 15:34 UTCEPSS rescore
  19. 2026-07-27 09:09 UTCOSV refresh
  20. 2026-07-26 14:53 UTCEPSS rescore
  21. 2026-07-25 14:16 UTCEPSS rescore
  22. 2026-07-24 14:16 UTCEPSS rescore
  23. 2026-07-23 14:16 UTCEPSS rescore
  24. 2026-07-23 02:29 UTCEG score recompute
  25. 2026-07-22 23:16 UTCEG score recompute
Show 75 more
  1. 2026-07-22 14:07 UTCEPSS rescore
  2. 2026-07-22 14:07 UTCEPSS rescore
  3. 2026-07-21 15:23 UTCEPSS rescore
  4. 2026-07-20 17:06 UTCEPSS rescore
  5. 2026-07-19 14:30 UTCEPSS rescore
  6. 2026-07-19 14:29 UTCEPSS rescore
  7. 2026-07-19 02:27 UTCEPSS rescore
  8. 2026-07-19 02:27 UTCEPSS rescore
  9. 2026-07-18 10:03 UTCEPSS rescore
  10. 2026-07-18 10:03 UTCEPSS rescore
  11. 2026-07-16 17:01 UTCEPSS rescore
  12. 2026-07-15 01:59 UTCEPSS rescore
  13. 2026-07-15 01:59 UTCEPSS rescore
  14. 2026-07-13 22:28 UTCEPSS rescore
  15. 2026-07-13 22:28 UTCEPSS rescore
  16. 2026-07-13 06:11 UTCEPSS rescore
  17. 2026-07-12 05:45 UTCEPSS rescore
  18. 2026-07-12 05:45 UTCEPSS rescore
  19. 2026-07-10 03:53 UTCOSV refresh
  20. 2026-07-09 19:08 UTCEPSS rescore
  21. 2026-07-08 15:13 UTCEPSS rescore
  22. 2026-07-07 13:45 UTCEPSS rescore
  23. 2026-07-07 13:44 UTCEPSS rescore
  24. 2026-07-06 16:26 UTCEPSS rescore
  25. 2026-07-06 16:26 UTCEPSS rescore
  26. 2026-07-05 02:29 UTCEPSS rescore
  27. 2026-07-04 06:29 UTCEPSS rescore
  28. 2026-07-01 15:05 UTCEPSS rescore
  29. 2026-06-30 23:21 UTCEPSS rescore
  30. 2026-06-30 23:21 UTCEPSS rescore
  31. 2026-06-29 14:05 UTCEPSS rescore
  32. 2026-06-28 14:06 UTCEPSS rescore
  33. 2026-06-28 14:06 UTCEPSS rescore
  34. 2026-06-28 04:55 UTCEPSS rescore
  35. 2026-06-27 03:07 UTCEPSS rescore
  36. 2026-06-25 13:48 UTCEPSS rescore
  37. 2026-06-25 13:48 UTCEPSS rescore
  38. 2026-06-24 14:04 UTCEPSS rescore
  39. 2026-06-24 14:04 UTCEPSS rescore
  40. 2026-06-23 21:31 UTCEPSS rescore
  41. 2026-06-23 21:31 UTCEPSS rescore
  42. 2026-06-22 14:24 UTCEPSS rescore
  43. 2026-06-22 14:24 UTCEPSS rescore
  44. 2026-06-21 14:55 UTCEPSS rescore
  45. 2026-06-21 14:55 UTCEPSS rescore
  46. 2026-06-21 14:31 UTCOSV refresh
  47. 2026-06-21 01:58 UTCEPSS rescore
  48. 2026-06-21 01:58 UTCEPSS rescore
  49. 2026-06-19 19:24 UTCEPSS rescore
  50. 2026-06-19 19:24 UTCEPSS rescore
  51. 2026-06-18 17:51 UTCEPSS rescore
  52. 2026-06-17 17:51 UTCEPSS rescore
  53. 2026-06-16 17:51 UTCEPSS rescore
  54. 2026-06-16 17:51 UTCEPSS rescore
  55. 2026-06-15 17:47 UTCEPSS rescore
  56. 2026-06-14 23:16 UTCEPSS rescore
  57. 2026-06-13 22:59 UTCEPSS rescore
  58. 2026-06-13 22:59 UTCEPSS rescore
  59. 2026-06-12 23:11 UTCEPSS rescore
  60. 2026-06-11 13:59 UTCEPSS rescore
  61. 2026-06-10 22:17 UTCEPSS rescore
  62. 2026-06-10 13:21 UTCEPSS rescore
  63. 2026-06-08 14:16 UTCEPSS rescore
  64. 2026-06-08 14:16 UTCEPSS rescore
  65. 2026-06-07 15:24 UTCEPSS rescore
  66. 2026-06-07 15:24 UTCEPSS rescore
  67. 2026-06-06 13:46 UTCEPSS rescore
  68. 2026-06-06 13:46 UTCEPSS rescore
  69. 2026-06-05 22:46 UTCEPSS rescore
  70. 2026-06-05 22:46 UTCEPSS rescore
  71. 2026-06-05 06:09 UTCEPSS rescore
  72. 2026-06-05 06:09 UTCEPSS rescore
  73. 2026-06-04 13:11 UTCEPSS rescore
  74. 2026-06-04 13:11 UTCEPSS rescore
  75. 2026-06-02 20:12 UTCEPSS rescore

Related CVEs(same product)

Frequently asked(5)

What is CVE-2023-53692?
CVE-2023-53692 is a high vulnerability published on October 22, 2025. In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free read in ext4findextent for bigalloc + inline Syzbot found the following issue: loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without…
When was CVE-2023-53692 disclosed?
CVE-2023-53692 was first published in the National Vulnerability Database on October 22, 2025, with the most recent update on August 5, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2023-53692 actively exploited?
CVE-2023-53692 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 95.4% of all scored CVEs.
What is the CVSS score of CVE-2023-53692?
CVE-2023-53692 has a CVSS v4.0 base score of 7.8 (CNA self-assessment; NVD's own analysis pending).
How do I remediate CVE-2023-53692?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2023-53692, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2023-53692

Explore →

Is Your Infrastructure Affected by CVE-2023-53692?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs