CVE-2023-53165

udf: Fix uninitialized array access for some pathnames

State: Published
Severity: Not scored
Published: Sep 15, 2025
Updated: May 11, 2026
Reserved: Sep 15, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

udf: Fix uninitialized array access for some pathnames

For filenames that begin with . and are between 2 and 5 characters long, UDF charset conversion code would read uninitialized memory in the output buffer. The only practical impact is that the name may be prepended a "unification hash" when it is not actually needed but still it is good to fix this.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	484a10f49387e4386bf2708532e75bf78ffea2cb to before 008ae78d1e12efa904dc819b1ec83e2bca6b2c56Affected 484a10f49387e4386bf2708532e75bf78ffea2cb to before b37f998d357102e8eb0f8eeb33f03fff22e49cbfAffected 484a10f49387e4386bf2708532e75bf78ffea2cb to before 3f1368af47acf4d0b2a5fb0d2c0d6919d2234b6dAffected 484a10f49387e4386bf2708532e75bf78ffea2cb to before 4503f6fc95d6dee85fb2c54785848799e192c51cAffected 484a10f49387e4386bf2708532e75bf78ffea2cb to before 985f9666698960dfc87a106d6314203fa90fda75Affected 484a10f49387e4386bf2708532e75bf78ffea2cb to before a6824149809395dfbb5bc36bc7057cc3cb84e56dAffected 484a10f49387e4386bf2708532e75bf78ffea2cb to before 4d50988da0db167aed6f38685145cb5cd526c4f8Affected 484a10f49387e4386bf2708532e75bf78ffea2cb to before 028f6055c912588e6f72722d89c30b401bbcf013Affected
LinuxLinux	4.6Affected before 4.6Not affected 4.14.324 through 4.14.Not affected 4.19.293 through 4.19.Not affected 5.4.255 through 5.4.Not affected 5.10.192 through 5.10.Not affected 5.15.123 through 5.15.Not affected 6.1.42 through 6.1.Not affected 6.4.7 through 6.4.*Not affected 6.5 and laterNot affected

Product

Versions

LinuxLinux

484a10f49387e4386bf2708532e75bf78ffea2cb to before 008ae78d1e12efa904dc819b1ec83e2bca6b2c56Affected
484a10f49387e4386bf2708532e75bf78ffea2cb to before b37f998d357102e8eb0f8eeb33f03fff22e49cbfAffected
484a10f49387e4386bf2708532e75bf78ffea2cb to before 3f1368af47acf4d0b2a5fb0d2c0d6919d2234b6dAffected
484a10f49387e4386bf2708532e75bf78ffea2cb to before 4503f6fc95d6dee85fb2c54785848799e192c51cAffected
484a10f49387e4386bf2708532e75bf78ffea2cb to before 985f9666698960dfc87a106d6314203fa90fda75Affected
484a10f49387e4386bf2708532e75bf78ffea2cb to before a6824149809395dfbb5bc36bc7057cc3cb84e56dAffected
484a10f49387e4386bf2708532e75bf78ffea2cb to before 4d50988da0db167aed6f38685145cb5cd526c4f8Affected
484a10f49387e4386bf2708532e75bf78ffea2cb to before 028f6055c912588e6f72722d89c30b401bbcf013Affected

LinuxLinux

4.6Affected
before 4.6Not affected
4.14.324 through 4.14.*Not affected
4.19.293 through 4.19.*Not affected
5.4.255 through 5.4.*Not affected
5.10.192 through 5.10.*Not affected
5.15.123 through 5.15.*Not affected
6.1.42 through 6.1.*Not affected
6.4.7 through 6.4.*Not affected
6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.