LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54313: ovl: fix null pointer dereference in ovl_get_acl_rcu()

In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovl_get_acl_rcu() Following process: P1 P2 path_openat link_path_walk may_lookup inode_permission(rcu) ovl_permission acl_permission_check check_acl get_cached_acl_rcu ovl_get_inode_acl realinode = ovl_inode_real(ovl_inode) drop_cache __dentry_kill(ovl_dentry) iput(ovl_inode) ovl_destroy_inode(ovl_inode) dput(oi->__upperdentry) dentry_kill(upperdentry) dentry_unlink_inode upperdentry->d_inode = NULL ovl_inode_upper upperdentry = ovl_i_dentry_upper(ovl_inode) d_inode(upperdentry) // returns NULL IS_POSIXACL(realinode) // NULL pointer dereference , will trigger an null pointer dereference at realinode: [ 205.472797] BUG: kernel NULL pointer dereference, address: 0000000000000028 [ 205.476701] CPU: 2 PID: 2713 Comm: ls Not tainted 6.3.0-12064-g2edfa098e750-dirty #1216 [ 205.478754] RIP: 0010:do_ovl_get_acl+0x5d/0x300 [ 205.489584] Call Trace: [ 205.489812] <TASK> [ 205.490014] ovl_get_inode_acl+0x26/0x30 [ 205.490466] get_cached_acl_rcu+0x61/0xa0 [ 205.490908] generic_permission+0x1bf/0x4e0 [ 205.491447] ovl_permission+0x79/0x1b0 [ 205.491917] inode_permission+0x15e/0x2c0 [ 205.492425] link_path_walk+0x115/0x550 [ 205.493311] path_lookupat.isra.0+0xb2/0x200 [ 205.493803] filename_lookup+0xda/0x240 [ 205.495747] vfs_fstatat+0x7b/0xb0 Fetch a reproducer in [Link]. Use the helper ovl_i_path_realinode() to get realinode and then do non-nullptr checking.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash kernel code when OverlayFS handles ACL permission checks during a race with cache cleanup. The public record does not provide a CVSS score or confirm active exploitation. Business impact is mainly availability risk on systems using affected kernels and OverlayFS.

Executive priority

Treat this as a patch-management item for Linux systems using OverlayFS. Urgency increases where a crash would disrupt critical workloads, but the provided evidence does not support emergency treatment based on active exploitation.

Technical view

CVE-2023-54313 is a NULL pointer dereference in OverlayFS ovl_get_acl_rcu(). A race can leave the upper dentry without an inode while ACL checks still dereference the real inode. The fix uses ovl_i_path_realinode() and adds non-null checking before POSIX ACL handling.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions with OverlayFS in use. The source lists affected versions including 5.15, 5.15.121, 6.1.40, 6.4.4, and 6.5, but does not provide full vendor package mappings.

Exploitation context

The CVE text mentions a reproducer, but the provided bundle does not include a link. CISA KEV status is false, and no cited source states active exploitation. The described outcome is a kernel NULL pointer dereference during filesystem permission processing.

Researcher notes

The vulnerable path involves ACL lookup under RCU during ovl_permission and get_cached_acl_rcu, racing with drop_cache and dentry teardown. The available sources support denial-of-service-style crash risk, not privilege escalation or remote exploitation.

Mitigation direction

  • Update to a Linux kernel containing one of the referenced stable fixes.
  • Check your Linux distribution advisory for the corrected kernel package.
  • Prioritize systems where OverlayFS is enabled or operationally required.
  • Use vendor guidance if backported package versioning obscures upstream kernel versions.

Validation and detection

  • Inventory Linux kernel versions across servers and appliances.
  • Identify systems with OverlayFS mounted or used by workloads.
  • Confirm fixed commits or vendor backports in kernel changelogs.
  • Review kernel logs for OverlayFS-related NULL dereference crashes.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54313 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux332f606b32b6291a944c8cf23b91f53a6e676525, 332f606b32b6291a944c8cf23b91f53a6e676525, 332f606b32b6291a944c8cf23b91f53a6e676525, 332f606b32b6291a944c8cf23b91f53a6e676525unaffected
LinuxLinux5.15, 0, 5.15.121, 6.1.40, 6.4.4, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.