CVE-2023-53695

udf: Detect system inodes linked into directory hierarchy

State: Published
Severity: 7.8 High
Published: Oct 22, 2025
Updated: Oct 15, 2026
Reserved: Oct 22, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

udf: Detect system inodes linked into directory hierarchy

When UDF filesystem is corrupted, hidden system inodes can be linked into directory hierarchy which is an avenue for further serious corruption of the filesystem and kernel confusion as noticed by syzbot fuzzed images. Refuse to access system inodes linked into directory hierarchy and vice versa.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6174c2eb8ecef271159bdcde460ce8af54d8f72f to before 1dc71eeb198a8daa17d0c995998a53b0b749a158Affected 6174c2eb8ecef271159bdcde460ce8af54d8f72f to before d747b31e2925a2f384e7dd1901a2e5bc5f984ed8Affected 6174c2eb8ecef271159bdcde460ce8af54d8f72f to before a44ec34b90440ada190924f5908b97026504fdcdAffected 6174c2eb8ecef271159bdcde460ce8af54d8f72f to before 37e74003d81e79457535cbbdfa1603431c03fac0Affected 6174c2eb8ecef271159bdcde460ce8af54d8f72f to before 1f328751b65c49c13a312d67a3bf27766b85baf7Affected 6174c2eb8ecef271159bdcde460ce8af54d8f72f to before 9e3b5ef7d02eaa6553e79b4af9bd99227280f245Affected 6174c2eb8ecef271159bdcde460ce8af54d8f72f to before 85a37983ec69cc9fcd188bc37c4de15ee326355aAffected 801c7a20d255e300ab51a6fcb1d0e218d136b16fAffected 3.17.2 to before 3.18Affected
LinuxLinux	3.18Affected before 3.18Not affected 4.19.278 through 4.19.Not affected 5.4.235 through 5.4.Not affected 5.10.173 through 5.10.Not affected 5.15.99 through 5.15.Not affected 6.1.16 through 6.1.Not affected 6.2.3 through 6.2.Not affected 6.3 and laterNot affected

Product

Versions

LinuxLinux

6174c2eb8ecef271159bdcde460ce8af54d8f72f to before 1dc71eeb198a8daa17d0c995998a53b0b749a158Affected
6174c2eb8ecef271159bdcde460ce8af54d8f72f to before d747b31e2925a2f384e7dd1901a2e5bc5f984ed8Affected
6174c2eb8ecef271159bdcde460ce8af54d8f72f to before a44ec34b90440ada190924f5908b97026504fdcdAffected
6174c2eb8ecef271159bdcde460ce8af54d8f72f to before 37e74003d81e79457535cbbdfa1603431c03fac0Affected
6174c2eb8ecef271159bdcde460ce8af54d8f72f to before 1f328751b65c49c13a312d67a3bf27766b85baf7Affected
6174c2eb8ecef271159bdcde460ce8af54d8f72f to before 9e3b5ef7d02eaa6553e79b4af9bd99227280f245Affected
6174c2eb8ecef271159bdcde460ce8af54d8f72f to before 85a37983ec69cc9fcd188bc37c4de15ee326355aAffected
801c7a20d255e300ab51a6fcb1d0e218d136b16fAffected
3.17.2 to before 3.18Affected

LinuxLinux

3.18Affected
before 3.18Not affected
4.19.278 through 4.19.*Not affected
5.4.235 through 5.4.*Not affected
5.10.173 through 5.10.*Not affected
5.15.99 through 5.15.*Not affected
6.1.16 through 6.1.*Not affected
6.2.3 through 6.2.*Not affected
6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.