CVE-2023-53683

fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()

State: Published
Severity: 7.8 High
Published: Oct 7, 2025
Updated: Aug 5, 2026
Reserved: Oct 7, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()

syzbot is hitting WARN_ON() in hfsplus_cat_{read,write}_inode(), for crafted filesystem image can contain bogus length. There conditions are not kernel bugs that can justify kernel to panic.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f62f5ee63052324ad94dd05091743d9e09f72070 to before 61af77acd039ffd221bf7adf0dc95d0a4d377505Affected ab778439c6fa0071698b62a351f79d319fd72c53 to before c074913b12db3632b11588b31bbfb0fa80a0a1c9Affected 781fa141414ef18b52f15037497155f80bf0ecab to before a75d9211a07fed513c08c5d4861c4a36ac6a74feAffected 1f881d9201f6e0a917004a14329f9ff3d0bfa1e5 to before c8daee66585897a4c90d937c91e762100237bff9Affected 48d9e2e6de01ed35e965eb549758a837c07b601d to before 37cab61a52d6f42b2d961c51bcf369f09e235fb5Affected 55d1cbbbb29e6656c662ee8f73ba1fc4777532eb to before 48960a503fcec76d3f72347b7e679dda08ca43beAffected 55d1cbbbb29e6656c662ee8f73ba1fc4777532eb to before 3a9d68d84b2e41ba3f2a727b36f035fad6800492Affected 55d1cbbbb29e6656c662ee8f73ba1fc4777532eb to before 81b21c0f0138ff5a499eafc3eb0578ad2a99622cAffected 4.14.303 to before 4.14.316Affected 4.19.270 to before 4.19.284Affected 5.4.229 to before 5.4.244Affected 5.10.163 to before 5.10.181Affected 5.15.87 to before 5.15.113Affected
LinuxLinux	5.16Affected before 5.16Not affected 4.14.316 through 4.14.Not affected 4.19.284 through 4.19.Not affected 5.4.244 through 5.4.Not affected 5.10.181 through 5.10.Not affected 5.15.113 through 5.15.Not affected 6.1.30 through 6.1.Not affected 6.3.4 through 6.3.*Not affected 6.4 and laterNot affected

Product

Versions

LinuxLinux

f62f5ee63052324ad94dd05091743d9e09f72070 to before 61af77acd039ffd221bf7adf0dc95d0a4d377505Affected
ab778439c6fa0071698b62a351f79d319fd72c53 to before c074913b12db3632b11588b31bbfb0fa80a0a1c9Affected
781fa141414ef18b52f15037497155f80bf0ecab to before a75d9211a07fed513c08c5d4861c4a36ac6a74feAffected
1f881d9201f6e0a917004a14329f9ff3d0bfa1e5 to before c8daee66585897a4c90d937c91e762100237bff9Affected
48d9e2e6de01ed35e965eb549758a837c07b601d to before 37cab61a52d6f42b2d961c51bcf369f09e235fb5Affected
55d1cbbbb29e6656c662ee8f73ba1fc4777532eb to before 48960a503fcec76d3f72347b7e679dda08ca43beAffected
55d1cbbbb29e6656c662ee8f73ba1fc4777532eb to before 3a9d68d84b2e41ba3f2a727b36f035fad6800492Affected
55d1cbbbb29e6656c662ee8f73ba1fc4777532eb to before 81b21c0f0138ff5a499eafc3eb0578ad2a99622cAffected
4.14.303 to before 4.14.316Affected
4.19.270 to before 4.19.284Affected
5.4.229 to before 5.4.244Affected
5.10.163 to before 5.10.181Affected
5.15.87 to before 5.15.113Affected

LinuxLinux

5.16Affected
before 5.16Not affected
4.14.316 through 4.14.*Not affected
4.19.284 through 4.19.*Not affected
5.4.244 through 5.4.*Not affected
5.10.181 through 5.10.*Not affected
5.15.113 through 5.15.*Not affected
6.1.30 through 6.1.*Not affected
6.3.4 through 6.3.*Not affected
6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.