LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53672: btrfs: output extra debug info if we failed to find an inline backref

In the Linux kernel, the following vulnerability has been resolved: btrfs: output extra debug info if we failed to find an inline backref [BUG] Syzbot reported several warning triggered inside lookup_inline_extent_backref(). [CAUSE] As usual, the reproducer doesn't reliably trigger locally here, but at least we know the WARN_ON() is triggered when an inline backref can not be found, and it can only be triggered when @insert is true. (I.e. inserting a new inline backref, which means the backref should already exist) [ENHANCEMENT] After the WARN_ON(), dump all the parameters and the extent tree leaf to help debug.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-53672 is a Linux kernel Btrfs issue where a kernel warning can be triggered when an expected inline extent backreference is not found. The public record does not describe data theft, privilege escalation, or a complete crash scenario. Treat it as kernel reliability risk until vendor guidance clarifies impact.

Executive priority

Handle through normal kernel maintenance unless Btrfs is widely used on critical systems. Increase priority where kernel warnings can trigger service disruption or where vendor advisories rate the issue higher than the CVE bundle currently shows.

Technical view

The issue is in Btrfs lookup_inline_extent_backref(). Syzbot reported WARN_ON() triggers when insert is true and an inline backref cannot be found. The referenced stable commits add diagnostic output after the warning. The CVE data lists Linux kernel ranges as affected, but provides no CVSS, CWE, or detailed exploit preconditions.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions with Btrfs in use or reachable. The source bundle does not prove exposure for non-Btrfs deployments, nor does it specify required local privileges, filesystem state, or mount options.

Exploitation context

The bundle says Syzbot found warning triggers. It does not cite public exploitation, and KEV is false. No source in the bundle confirms active exploitation, weaponized proof of concept, privilege escalation, or remote attackability.

Researcher notes

Evidence is sparse. The record describes a warning path and debug-output patch, not a clearly documented memory corruption or privilege boundary failure. Analyze the referenced stable commits and distribution advisories before assigning exploitability or impact beyond kernel reliability.

Mitigation direction

  • Check your Linux distribution's advisory for this CVE.
  • Update to a vendor kernel containing the referenced stable commits.
  • Prioritize systems using Btrfs filesystems.
  • Review panic-on-warning settings on critical hosts.
  • Track vendor notes for impact and workaround details.

Validation and detection

  • Inventory Linux kernel versions across managed systems.
  • Identify hosts with Btrfs filesystems mounted or configured.
  • Map installed kernels against vendor CVE status.
  • Confirm whether vendor kernels include the referenced stable commits.
  • Review kernel logs for related Btrfs WARN_ON events.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53672 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux492104c866cb1b62a11393adccb477f5cd2c7768, 492104c866cb1b62a11393adccb477f5cd2c7768, 492104c866cb1b62a11393adccb477f5cd2c7768, 492104c866cb1b62a11393adccb477f5cd2c7768, 492104c866cb1b62a11393adccb477f5cd2c7768, 492104c866cb1b62a11393adccb477f5cd2c7768, 492104c866cb1b62a11393adccb477f5cd2c7768, 492104c866cb1b62a11393adccb477f5cd2c7768unaffected
LinuxLinux3.9, 0, 4.14.326, 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55, 6.5.5, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.