CVE-2023-53672: linux kernel — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: output extra debug info if we failed to find an inline backref [BUG] Syzbot reported several warning triggered inside lookup_inline_extent_backref(). [CAUSE] As usual, the reproducer doesn't reliably trigger locally here, but at least we know the WARN_ON() is triggered when an inline backref can not be found, and it can only be triggered when @insert is true. (I.e. inserting a new inline backref, which means the backref should already exist) [ENHANCEMENT] After the WARN_ON(), dump all the parameters and the extent tree leaf to help debug.

Is your site exposed to CVE-2023-53672?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
linux	linux_kernel	3.9.1 — 4.14.326
linux	linux_kernel	4.15 — 4.19.295
linux	linux_kernel	4.20 — 5.4.257
linux	linux_kernel	5.5 — 5.10.197
linux	linux_kernel	5.11 — 5.15.133
linux	linux_kernel	5.16 — 6.1.55
linux	linux_kernel	6.2 — 6.5.5
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All

References

Advisories & Patches

https://git.kernel.org/stable/c/28062cd6eda04035d8f6ded2001292ac8b496149 https://git.kernel.org/stable/c/376b41524b71e494514720bd6114325b0a2ed19c https://git.kernel.org/stable/c/400e08a16604b534fdd82c5a288fa150d04f5f79 https://git.kernel.org/stable/c/6994f806c6d1ae8b59344d3700358547f3b3fe1d https://git.kernel.org/stable/c/7afbfde45d665953b4d5a42a721e15bf0315d89b https://git.kernel.org/stable/c/7f72f50547b7af4ddf985b07fc56600a4deba281 https://git.kernel.org/stable/c/b7c3cf2f6c42e6688b1c37215a0b1663f982f915 https://git.kernel.org/stable/c/e70ba449b04b40584bdabb383d10455397cbf177

Frequently Asked Questions

What is CVE-2023-53672? +

In the Linux kernel, the following vulnerability has been resolved: btrfs: output extra debug info if we failed to find an inline backref [BUG] Syzbot reported several warning triggered inside lookup_inline_extent_backref(). [CAUSE] As usual, the reproducer doesn't reliably trigger locally here, but at least we know the WARN_ON() is triggered when an inline backref can not be found, and it can only be triggered when @insert is true. (I.e. inserting a new inline backref, which means the backref should already exist) [ENHANCEMENT] After the WARN_ON(), dump all the parameters and the extent tree leaf to help debug. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2023-53672? +

CVE-2023-53672 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2023-53672? +

CVE-2023-53672 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-53672? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-9588 10.0

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. …

CVE-2025-57870 10.0

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This …

CVE-2026-48286 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2026-13782 10.0

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer …

CVE-2026-48303 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2025-34028 10.0

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when …

CVE-2023-53672