LiveActive security incident?Get immediate response
CVE Record

CVE-2023-52590: ocfs2: Avoid touching renamed directory if parent does not change

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Avoid touching renamed directory if parent does not change The VFS will not be locking moved directory if its parent does not change. Change ocfs2 rename code to avoid touching renamed directory if its parent does not change as without locking that can corrupt the filesystem.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel OCFS2 filesystem bug. During some directory renames, the kernel may modify a directory without the expected VFS locking when the parent directory stays the same. The stated impact is filesystem corruption, not confirmed remote code execution or data theft.

Executive priority

Treat as targeted infrastructure hygiene unless OCFS2 is used in critical clustered storage. For OCFS2-dependent systems, prioritize patch planning because filesystem corruption can cause service disruption and recovery work.

Technical view

The OCFS2 rename path touched the renamed directory even when VFS did not lock it because the parent was unchanged. The resolved kernel change avoids that operation in this case. The CVE data provides no CVSS, CWE, or detailed exploit preconditions.

Likely exposure

Exposure appears limited to Linux systems running affected kernels where OCFS2 is present and used. The source bundle's affected-version data is sparse, so confirm against kernel and distribution advisories before scoping production impact.

Exploitation context

CISA KEV status is false in the provided bundle, and no cited source claims active exploitation. The public description indicates a corruption risk caused by filesystem rename behavior, with no exploit method or attacker path provided.

Researcher notes

The available evidence supports a concurrency or locking flaw in OCFS2 rename handling. Missing details include CVSS, CWE, exploitability requirements, and distribution-specific fix mapping. Avoid assuming broader Linux filesystem exposure beyond OCFS2.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable fixes.
  • Prioritize systems using OCFS2 or clustered filesystem workloads.
  • Check Linux distribution advisories for exact affected and fixed package versions.
  • Maintain verified backups before and after kernel maintenance.
  • Run filesystem integrity checks using vendor-supported procedures after suspected corruption.

Validation and detection

  • Inventory Linux kernel versions across systems.
  • Identify hosts where OCFS2 is installed, loaded, mounted, or required.
  • Compare kernels with the CVE record and referenced stable commits.
  • Review vendor advisories for package-specific fixed versions.
  • Check operational reports for unexplained OCFS2 corruption or rename-related failures.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-52590 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxccd979bdbce9fba8412beb3f1de68a9d0171b12c, ccd979bdbce9fba8412beb3f1de68a9d0171b12cunaffected
LinuxLinux2.6.16, 0, 6.7.4, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.