CVE-2023-53813: ext4: fix rbtree traversal bug in ext4_mb_use_preallocated
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix rbtree traversal bug in ext4_mb_use_preallocated
During allocations, while looking for preallocations(PA) in the per
inode rbtree, we can't do a direct traversal of the tree because
ext4_mb_discard_group_preallocation() can paralelly mark the pa deleted
and that can cause direct traversal to skip some entries. This was
leading to a BUG_ON() being hit [1] when we missed a PA that could satisfy
our request and ultimately tried to create a new PA that would overlap
with the missed one.
To makes sure we handle that case while still keeping the performance of
the rbtree, we make use of the fact that the only pa that could possibly
overlap the original goal start is the one that satisfies the below
conditions:
1. It must have it's logical start immediately to the left of
(ie less than) original logical start.
2. It must not be deleted
To find this pa we use the following traversal method:
1. Descend into the rbtree normally to find the immediate neighboring
PA. Here we keep descending irrespective of if the PA is deleted or if
it overlaps with our request etc. The goal is to find an immediately
adjacent PA.
2. If the found PA is on right of original goal, use rb_prev() to find
the left adjacent PA.
3. Check if this PA is deleted and keep moving left with rb_prev() until
a non deleted PA is found.
4. This is the PA we are looking for. Now we can check if it can satisfy
the original request and proceed accordingly.
This approach also takes care of having deleted PAs in the tree.
(While we are at it, also fix a possible overflow bug in calculating the
end of a PA)
[1] https://lore.kernel.org/linux-ext4/CA+G9fYv2FRpLqBZf34ZinR8bU2_ZRAUOjKAD3+tKRFaEQHtt8Q@mail.gmail.com/
Security readout for executives and security teams
Plain-English summary
This is a Linux ext4 filesystem bug where normal allocation bookkeeping can become inconsistent and hit a kernel BUG condition. The provided sources do not give a CVSS score or confirmed exploitation. Business impact is most likely service instability on affected Linux systems using ext4, not a clearly documented remote compromise path.
Executive priority
Treat this as a stability and availability risk for affected Linux ext4 systems. It should be handled through normal kernel patch management, with higher priority for production servers where an unexpected kernel crash would disrupt critical services.
Technical view
In ext4_mb_use_preallocated, direct rbtree traversal of per-inode preallocations could miss a valid non-deleted PA while another path marks entries deleted. The allocator could then create an overlapping PA and hit BUG_ON. The fix changes traversal to find the left neighbor safely, skip deleted PAs, and correct a possible PA-end overflow.
Likely exposure
Exposure appears limited to Linux systems running affected 6.4-era kernels and using ext4. The bundle identifies Linux 6.4, 6.4.8, and 6.5-related version data, but package-level affected ranges depend on each distribution’s backports.
Exploitation context
The source bundle marks KEV as false and provides no evidence of active exploitation or public exploit use. The described failure arises during ext4 allocation and preallocation handling; no remote attack vector, privilege escalation outcome, or weaponized technique is documented in the provided sources.
Researcher notes
The evidence is narrow but technically specific: a concurrency-sensitive rbtree traversal bug in ext4 preallocation handling, plus an overflow correction. The bundle does not establish exploitability beyond hitting BUG_ON, and does not document attacker requirements, affected distro packages, or a CVSS vector.
Mitigation direction
Check your Linux distribution advisory for CVE-2023-53813 kernel packages.
Update to a kernel build containing the referenced stable ext4 fixes.
Prioritize ext4-backed servers on affected 6.4-era kernels.
If patch timing is constrained, monitor for kernel BUG/Oops events around ext4 allocation.
Validation and detection
Inventory Linux kernel versions on ext4-backed systems.
Confirm whether vendor kernel changelogs include CVE-2023-53813 or the stable commits.
Review system logs for ext4 BUG_ON, Oops, or panic events.
Verify patched systems are running the updated kernel after reboot.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-53813 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
3Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Dec 9, 2025, 00:01 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.