CVE-2023-53777: erofs: kill hooked chains to avoid loops on deduplicated compressed images
In the Linux kernel, the following vulnerability has been resolved:
erofs: kill hooked chains to avoid loops on deduplicated compressed images
After heavily stressing EROFS with several images which include a
hand-crafted image of repeated patterns for more than 46 days, I found
two chains could be linked with each other almost simultaneously and
form a loop so that the entire loop won't be submitted. As a
consequence, the corresponding file pages will remain locked forever.
It can be _only_ observed on data-deduplicated compressed images.
For example, consider two chains with five pclusters in total:
Chain 1: 2->3->4->5 -- The tail pcluster is 5;
Chain 2: 5->1->2 -- The tail pcluster is 2.
Chain 2 could link to Chain 1 with pcluster 5; and Chain 1 could link
to Chain 2 at the same time with pcluster 2.
Since hooked chains are all linked locklessly now, I have no idea how
to simply avoid the race. Instead, let's avoid hooked chains completely
until I could work out a proper way to fix this and end users finally
tell us that it's needed to add it back.
Actually, this optimization can be found with multi-threaded workloads
(especially even more often on deduplicated compressed images), yet I'm
not sure about the overall system impacts of not having this compared
with implementation complexity.
Security readout for executives and security teams
Plain-English summary
CVE-2023-53777 is a Linux kernel EROFS issue where certain deduplicated compressed filesystem images can trigger a loop in internal processing. The described impact is files pages staying locked forever, which points to availability risk rather than data theft. The source does not provide a CVSS score or evidence of active exploitation.
Executive priority
Treat this as a targeted availability issue. Prioritize systems that mount EROFS images from less-trusted sources or support device, container, or image-processing workflows. It is not KEV-listed and has no supplied CVSS score, so broad emergency action is not supported by the provided evidence.
Technical view
The EROFS decompression path could link two lockless hooked chains to each other on data-deduplicated compressed images, preventing the loop from being submitted. Kernel notes say affected file pages remain locked forever. The fix removes hooked chains until a safer implementation exists. Affected version data is limited and should be verified against distribution kernels.
Likely exposure
Exposure is most likely on Linux systems that support or mount EROFS data-deduplicated compressed images. Risk is higher where images come from build pipelines, devices, or users outside strict trust boundaries. The bundle lists Linux 6.0, 6.1.39, 6.3.13, 6.4.4, and 6.5 as affected, but version data is incomplete.
Exploitation context
No cited source says this is being exploited in the wild, and it is not marked KEV. The upstream description references a hand-crafted repeated-pattern image and a long stress test. That supports a plausible denial-of-service condition, but not a confirmed public exploit or privilege escalation.
Researcher notes
The core condition is a race between lockless hooked chains on deduplicated compressed EROFS images. Upstream chose to remove the optimization rather than preserve the behavior. The source bundle does not include CWE, CVSS, exploitability scoring, or detailed product-specific downstream affected ranges.
Mitigation direction
Check vendor or distribution kernel advisories for CVE-2023-53777 fixes.
Update affected Linux kernels to builds containing the referenced stable commits.
Avoid mounting untrusted EROFS deduplicated compressed images until patched.
Restrict EROFS image ingestion to trusted build and release pipelines.
Track upstream Linux stable guidance if distribution patches are unavailable.
Validation and detection
Inventory Linux kernel versions across systems that may use EROFS.
Confirm whether EROFS support is enabled or loaded on relevant hosts.
Identify workflows that mount or process deduplicated compressed EROFS images.
Map installed kernels against distribution advisories and the upstream stable commits.
Review system logs for unexplained hangs around EROFS image access.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-53777 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
5Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Dec 9, 2025, 00:00 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.