In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix sysfs interface lifetime
The current nilfs2 sysfs support has issues with the timing of creation
and deletion of sysfs entries, potentially leading to null pointer
dereferences, use-after-free, and lockdep warnings.
Some of the sysfs attributes for nilfs2 per-filesystem instance refer to
metadata file "cpfile", "sufile", or "dat", but
nilfs_sysfs_create_device_group that creates those attributes is executed
before the inodes for these metadata files are loaded, and
nilfs_sysfs_delete_device_group which deletes these sysfs entries is
called after releasing their metadata file inodes.
Therefore, access to some of these sysfs attributes may occur outside of
the lifetime of these metadata files, resulting in inode NULL pointer
dereferences or use-after-free.
In addition, the call to nilfs_sysfs_create_device_group() is made during
the locking period of the semaphore "ns_sem" of nilfs object, so the
shrinker call caused by the memory allocation for the sysfs entries, may
derive lock dependencies "ns_sem" -> (shrinker) -> "locks acquired in
nilfs_evict_inode()".
Since nilfs2 may acquire "ns_sem" deep in the call stack holding other
locks via its error handler __nilfs_error(), this causes lockdep to report
circular locking. This is a false positive and no circular locking
actually occurs as no inodes exist yet when
nilfs_sysfs_create_device_group() is called. Fortunately, the lockdep
warnings can be resolved by simply moving the call to
nilfs_sysfs_create_device_group() out of "ns_sem".
This fixes these sysfs issues by revising where the device's sysfs
interface is created/deleted and keeping its lifetime within the lifetime
of the metadata files above.
Security readout for executives and security teams
Plain-English summary
CVE-2023-53440 is a Linux kernel nilfs2 filesystem bug. Local users could trigger kernel crashes through sysfs lifetime errors, causing denial of service. The business impact is availability, not data theft, based on the supplied CVSS vector.
Executive priority
Treat as a normal kernel maintenance priority unless nilfs2 is used on shared or multi-user systems. The likely impact is system crash or disruption, not confirmed compromise.
Technical view
The nilfs2 sysfs interface could expose attributes before metadata inodes are loaded or after release. Access outside the metadata lifetime may cause NULL pointer dereference or use-after-free. The upstream fix changes sysfs device group creation and deletion timing.
Likely exposure
Exposure is limited to Linux systems with vulnerable kernels where nilfs2 support is present and local low-privileged access is possible. Internet-facing remote exposure is not indicated by the source bundle.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of active exploitation. The CVSS vector is local, low complexity, low privilege, no user interaction, with high availability impact.
Researcher notes
Relevant code area is nilfs2 sysfs lifetime management around metadata files cpfile, sufile, and dat. Evidence supports CWE-476 and availability impact; exploitability details beyond local privileged context are not provided.
Mitigation direction
Apply a Linux kernel update containing the referenced stable nilfs2 fixes.
Prioritize hosts where untrusted users can obtain local accounts or run workloads.
If updates are delayed, check distribution vendor guidance for nilfs2-specific temporary controls.
Track vendor advisories because package backports may not match upstream version numbers.
Validation and detection
Inventory Linux kernel versions across servers, workstations, and container hosts.
Check whether nilfs2 support is enabled, loaded, or used on each system.
Compare installed kernels with distribution advisories or the referenced stable commits.
Review local-user and multi-tenant systems first for availability risk.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE-476 · source CWE mapping
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.