LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54311: ext4: fix deadlock when converting an inline directory in nojournal mode

In the Linux kernel, the following vulnerability has been resolved: ext4: fix deadlock when converting an inline directory in nojournal mode In no journal mode, ext4_finish_convert_inline_dir() can self-deadlock by calling ext4_handle_dirty_dirblock() when it already has taken the directory lock. There is a similar self-deadlock in ext4_incvert_inline_data_nolock() for data files which we'll fix at the same time. A simple reproducer demonstrating the problem: mke2fs -Fq -t ext2 -O inline_data -b 4k /dev/vdc 64 mount -t ext4 -o dirsync /dev/vdc /vdc cd /vdc mkdir file0 cd file0 touch file0 touch file1 attr -s BurnSpaceInEA -V abcde . touch supercalifragilisticexpialidocious

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-54311 is a Linux kernel ext4 flaw that can make file operations deadlock when converting inline directories on filesystems running without a journal. The business impact is likely availability, not data theft, based on the provided sources. Exposure depends on specific ext4 configuration and kernel version.

Executive priority

Treat this as a targeted availability risk, not a broad emergency. Patch during normal kernel maintenance, accelerating for systems with untrusted local users, container workloads, or nojournal ext4 storage handling important operations.

Technical view

In ext4 nojournal mode, ext4_finish_convert_inline_dir() can call ext4_handle_dirty_dirblock() while already holding the directory lock, causing self-deadlock. The source also notes a similar deadlock path for inline data files. Stable kernel fix commits are referenced, but no CVSS or CWE is supplied.

Likely exposure

Likely exposure is Linux systems running affected kernels with ext4 filesystems configured without journaling and using inline data. General Linux systems using other filesystems, normal journaled ext4, or vendor-patched kernels may not be affected. Vendor backports can change version conclusions.

Exploitation context

The source bundle says KEV is false and provides no evidence of active exploitation. The included reproducer is local filesystem activity, so the documented risk appears to be local availability impact rather than remote code execution or credential theft.

Researcher notes

Root cause is self-deadlock during inline directory or data conversion in ext4 nojournal paths. The prompt provides stable commit references but no CVSS, CWE, or exploitation evidence. Version metadata is incomplete, so confirm branch boundaries against upstream commits and distribution advisories.

Mitigation direction

  • Update to a vendor kernel containing the referenced ext4 stable fixes.
  • Prioritize hosts using ext4 without journaling and inline_data enabled.
  • Check distribution advisories for backported fixes before relying on upstream version numbers.
  • Avoid nojournal ext4 configurations where operationally feasible until patched.

Validation and detection

  • Inventory kernels and map them to vendor advisories for CVE-2023-54311.
  • Identify ext4 filesystems mounted without journaling and with inline_data support.
  • Review monitoring for unexplained ext4 hangs or blocked file operations.
  • Confirm the fix commit is present or backported in deployed kernel packages.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54311 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49bunaffected
LinuxLinux3.8, 0, 5.4.243, 5.10.180, 5.15.112, 6.1.29, 6.2.16, 6.3.3, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.