CVE-2023-52436

f2fs: explicitly null-terminate the xattr list

State: Published
Severity: 7.8 High
Published: Feb 20, 2024
Updated: Aug 15, 2026
Reserved: Feb 20, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: explicitly null-terminate the xattr list

When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 16ae3132ff7746894894927c1892493693b89135Affected af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 12cf91e23b126718a96b914f949f2cdfeadc7b2aAffected af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 3e47740091b05ac8d7836a33afd8646b6863ca52Affected af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 32a6cfc67675ee96fe107aeed5af9776fec63f11Affected af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 5de9e9dd1828db9b8b962f7ca42548bd596deb8aAffected af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 2525d1ba225b5c167162fa344013c408e8b4de36Affected af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before f6c30bfe5a49bc38cae985083a11016800708feaAffected af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before e26b6d39270f5eab0087453d9b544189a38c8564Affected
LinuxLinux	3.8Affected before 3.8Not affected 4.19.306 through 4.19.Not affected 5.4.268 through 5.4.Not affected 5.10.209 through 5.10.Not affected 5.15.148 through 5.15.Not affected 6.1.74 through 6.1.Not affected 6.6.13 through 6.6.Not affected 6.7.1 through 6.7.*Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 16ae3132ff7746894894927c1892493693b89135Affected
af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 12cf91e23b126718a96b914f949f2cdfeadc7b2aAffected
af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 3e47740091b05ac8d7836a33afd8646b6863ca52Affected
af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 32a6cfc67675ee96fe107aeed5af9776fec63f11Affected
af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 5de9e9dd1828db9b8b962f7ca42548bd596deb8aAffected
af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before 2525d1ba225b5c167162fa344013c408e8b4de36Affected
af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before f6c30bfe5a49bc38cae985083a11016800708feaAffected
af48b85b8cd3fbb12c9b6759c16db6d69c0b03da to before e26b6d39270f5eab0087453d9b544189a38c8564Affected

LinuxLinux

3.8Affected
before 3.8Not affected
4.19.306 through 4.19.*Not affected
5.4.268 through 5.4.*Not affected
5.10.209 through 5.10.*Not affected
5.15.148 through 5.15.*Not affected
6.1.74 through 6.1.*Not affected
6.6.13 through 6.6.*Not affected
6.7.1 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.