CVE-2023-54062

None

CVSS

—

EPSS

0.2%

Published

Dec 24, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the Linux kernel's handling of file attributes on ext4 filesystems can cause memory errors that may crash the system or allow misuse.

Exploitation: Local Privilege
Attacker needs: Local User
Complexity: Moderate
Impact: Full Compromise
Component: OS kernel
Class: Use After Free
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Use-after-free in ext4_xattr_move_to_block() where a pointer to an xattr entry is dereferenced after removal from its original location to decide whether to kvfree() a kvmalloc()-allocated buffer, leading to invalid free or memory leak.

Why it matters to the business

Linux systems using ext4 filesystems may experience kernel crashes, memory corruption, or denial of service; the large number of downstream kernel dependents increases exposure across servers, containers, and embedded devices, though no ransomware or KEV usage is known.

How an attack unfolds

An attacker with local access crafts filesystem operations or a malicious ext4 image that triggers extended attribute movement to an external block, causing the kernel to perform an invalid kvfree on a non-kvmalloc pointer or leak memory, potentially leading to further corruption or code execution.

How to fix it

Upgrade the Linux kernel to a fixed version such as 4.14.315 or apply commit 76887be2a96193cd11be818551b8934ecdb3123f from the stable git tree; rebuild and reboot systems with the patched kernel.

How to confirm the fix worked

Verify the running kernel version against the fixed releases, inspect ext4 xattr code paths in source for the separate variable tracking the free condition, and test with synthetic workloads that exercise xattr movement to external blocks.

Typical attack path

Obtain local access or ability to mount attacker-controlled ext4 volumes
Perform xattr operations that cause an entry with value stored via kvmalloc to be moved to an external block
Trigger removal of the xattr entry before the validity check on entry->e_value_inum
Induce the erroneous kvfree or memory leak to corrupt kernel memory

How to detect it

Review kernel logs for oops or warnings referencing ext4_xattr_move_to_block or xattr entry handling; examine crash dumps for invalid kvfree calls involving ext4 buffers; no widespread exploitation indicators are known.

What your security team should do

Prioritize kernel upgrades on all ext4-using systems within standard patching windows given the low EPSS and absence from KEV
Monitor kernel changelogs for ext4 updates and backport the fix where immediate upgrade is not feasible
Limit untrusted ext4 volume mounts and xattr operations from unprivileged users

The record

In the Linux kernel, the following vulnerability has been resolved: ext4: fix invalid free tracking in ext4_xattr_move_to_block() In ext4_xattr_move_to_block(), the value of the extended attribute which we need to move to an external block may be allocated by kvmalloc() if the value is stored in an external inode. So at the end of the function the code tried to check if this was the case by testing entry->e_value_inum. However, at this point, the pointer to the xattr entry is no longer valid, because it was removed from the original location where it had been stored. So we could end up calling kvfree() on a pointer which was not allocated by kvmalloc(); or we could also potentially leak memory by not freeing the buffer when it should be freed. Fix this by storing whether it should be freed in a separate variable.

Affected packages

Ecosystem	Package	Introduced	Fixed
Linux	Kernel	0	4.14.315