CVE-2023-53450

In the Linux kernel, the following vulnerability has been resolved: ext4: remove a BUG_ON in ext4_mb_release_group_pa() If a malicious fuzzer overwrites the ext4 superblock while it is mounted such that the s_first_data_block is set to a very large number, the calculation of the block group can underflow, and trigger a BUG_ON check. Change this to be an ext4_warning so that we don't crash the kernel.

• crypto: algif_aead - Fix minimum RX size check for decryption {CVE-2026-31431}
• crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl {CVE-2026-31431}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-31431}
• crypto: authencesn - Fix src offset when decrypting in-place {CVE-2026-31431}
• crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption {CVE-2026-31431}
• crypto: authenc - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
• crypto: algif_aead - snapshot IV for async AEAD requests {CVE-2026-31431}
• crypto: algif_aead - Revert to operating out-of-place {CVE-2026-31431}
• crypto: algif_aead - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
• crypto: scatterwalk - Backport memcpy_sglist() {CVE-2026-31431}
• wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• intel_th: msu: Fix vmalloced buffers {CVE-2022-50142}
• vt: Clear selection before changing the font {CVE-2022-49948}
• ACPICA: Fix error code path in acpi_ds_call_control_method() {CVE-2022-50411}
• usbnet: Run unregister_netdev() before unbind_all() {CVE-2022-50220}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• bpf: Propagate error from htab_lock_bucket() to userspace {CVE-2022-50490}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• module: fix [e_shstrndx].sh_size=0 OOB access {CVE-2022-49444}
• ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• xsk: Fix xsk_diag use-after-free error during socket cleanup {CVE-2023-53426}
• svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
• net: hns3: add VLAN id validation before using {CVE-2025-71112}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• staging: vme_user: Fix possible UAF in tsi148_dma_list_add {CVE-2022-50384}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• ftrace: Add cond_resched() to ftrace_graph_set_hash() {CVE-2025-37940}
• net: stmmac: Fix accessing freed irq affinity_hint {CVE-2025-23155}
• ext4: set goal start correctly in ext4_mb_normalize_request {CVE-2023-54021}
• netfilter: ipset: fix region locking in hash types {CVE-2025-37997}
• openvswitch: Fix unsafe attribute parsing in output_userspace() {CVE-2025-37998}
• wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() {CVE-2025-37990}
• nfs: handle failure of nfs_get_lock_context in unlock path {CVE-2025-38023}
• drm/amd/pm: Prevent division by zero {CVE-2025-37767}
• netfilter: ctnetlink: remove refcounting in expectation dumpers {CVE-2025-39764}
• tracing: Fix null pointer dereference in tracing_err_log_open() {CVE-2023-53167}
• ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
• scsi: qla2xxx: Pointer may be dereferenced {CVE-2023-53150}
• net: pktgen: fix access outside of user given buffer in pktgen_thread_write() {CVE-2025-38061}
• dm cache: prevent BUG_ON by blocking retries on failed device resumes {CVE-2025-38066} -…

• fix: "vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}"
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
• net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag {CVE-2026-23105}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
• ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• via_wdt: fix critical boot hang due to unnamed resource allocation {CVE-2025-71114}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• Revert "fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}"
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• btrfs: output extra debug info if we failed to find an inline backref {CVE-2023-53672}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release(CVE-2023-53484)
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
• md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
• platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mxds|mx {CVE-2022-50521}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
• i2c: ismt: use correct length when copy buffer {CVE-2022-50394}
• misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
• kvm: avoid speculation-based attacks from out-of-range memslot accesses {CVE-2021-47277}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• USB: core: Add routines for endpoint checks in old drivers
• xen: sync some headers with xen tree
• squashfs: fix memory leak in squashfs_fill_super {CVE-2025-38415}
• pptp: fix pptp_xmit() error path {CVE-2025-38574}
• Revert "net/sched: sch_hfsc: Ensure inner classes have fsc curve" {CVE-2023-4623}

• fix: "vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}"
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
• net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag {CVE-2026-23105}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
• ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• via_wdt: fix critical boot hang due to unnamed resource allocation {CVE-2025-71114}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• Revert "fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}"
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• btrfs: output extra debug info if we failed to find an inline backref {CVE-2023-53672}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release(CVE-2023-53484)
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
• md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
• platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mxds|mx {CVE-2022-50521}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
• i2c: ismt: use correct length when copy buffer {CVE-2022-50394}
• misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
• kvm: avoid speculation-based attacks from out-of-range memslot accesses {CVE-2021-47277}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• USB: core: Add routines for endpoint checks in old drivers
• xen: sync some headers with xen tree
• squashfs: fix memory leak in squashfs_fill_super {CVE-2025-38415}
• pptp: fix pptp_xmit() error path {CVE-2025-38574}
• Revert "net/sched: sch_hfsc: Ensure inner classes have fsc curve" {CVE-2023-4623}

• fix: "vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}"
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
• net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag {CVE-2026-23105}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
• ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• via_wdt: fix critical boot hang due to unnamed resource allocation {CVE-2025-71114}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• Revert "fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}"
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• btrfs: output extra debug info if we failed to find an inline backref {CVE-2023-53672}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release(CVE-2023-53484)
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
• md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
• platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mxds|mx {CVE-2022-50521}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
• i2c: ismt: use correct length when copy buffer {CVE-2022-50394}
• misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
• kvm: avoid speculation-based attacks from out-of-range memslot accesses {CVE-2021-47277}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• USB: core: Add routines for endpoint checks in old drivers
• xen: sync some headers with xen tree
• squashfs: fix memory leak in squashfs_fill_super {CVE-2025-38415}
• pptp: fix pptp_xmit() error path {CVE-2025-38574}
• Revert "net/sched: sch_hfsc: Ensure inner classes have fsc curve" {CVE-2023-4623}

• smb: client: reject userspace cifs.spnego descriptions
• usb: ulpi: fix memory leak on ulpi_register() error paths
• usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
• mptcp: consolidate suboption status {CVE-2025-21707}
• blktrace: fix __this_cpu_read/write in preemptible context {CVE-2026-23374}
• espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097}
• net: usb: asix: validate PHY address before use {CVE-2025-71094}
• driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
• net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts {CVE-2026-22997}
• crypto: af_alg - Set merge to zero early in af_alg_sendmsg {CVE-2025-39931}
• bonding: fix use-after-free due to enslave fail after slave array update {CVE-2026-23171}
• Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT {CVE-2025-38335}
• spi: spi-fsl-lpspi: fix teardown order issue (UAF) {CVE-2026-31485}
• mm/smaps: fix race between smaps_hugetlb_range and migration {CVE-2025-39754}
• vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850}
• mm/userfaultfd: fix hugetlb fault mutex hash calculation {CVE-2026-31575}
• RDMA/irdma: Initialize free_qp completion before using it {CVE-2026-31492}
• calipso: Don't call calipso functions for AF_INET sk. {CVE-2025-38147}
• mm/ksm: fix flag-dropping behavior in ksm_madvise {CVE-2025-40040}
• espintcp: fix skb leaks {CVE-2025-38057}
• net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize {CVE-2023-53667}
• memcg: fix soft lockup in the OOM process {CVE-2024-57977}
• futex: Clear stale exiting pointer in futex_lock_pi() retry path {CVE-2026-31555}
• trace_events_hist: add check for return value of 'create_hist_field' {CVE-2023-53005}
• dm-verity: disable recursive forward error correction {CVE-2025-71161}
• Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395}
• vfs: Don't evict inode under the inode lru traversing context {CVE-2024-45003}
• ipvs: fix uninit-value for saddr in do_output_route4 {CVE-2025-37961}
• sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062}
• net: phy: leds: fix memory leak {CVE-2025-37989}
• x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper {CVE-2025-39681}
• tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149}
• netfilter: ctnetlink: remove refcounting in expectation dumpers {CVE-2025-39764}
• sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
• kobject: Add sanity check for kset->kobj.ktype in kset_register() {CVE-2023-53480}
• io_uring: check if iowq is killed before queuing {CVE-2024-56709}
• netfilter: x_tables: fix percpu counter block leak on error path when creating new netns {CVE-2023-53200}
• ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed {CVE-2023-53481}
• udf: Do not update file length for failed writes to inline files {CVE-2023-53295}
• bpf: Forget ranges when refining tnum after JSET {CVE-2025-39748}
• perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
• misc: vmw_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-53279}
• can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write {CVE-2023-53344}
• tracing: Fix race issue between cpu buffer write and swap {CVE-2023-53368}
• KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses {CVE-2025-23141}
• io_uring/tctx: work around xa_store() allocation error issue {CVE-2024-56584}
• objtool: Fix memory leak in create_static_call_sections() {CVE-2023-53423}
• net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
• ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
• PM: EM: fix memory leak with using debugfs_lookup() {CVE-2023-53411}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• watchdog: Fix kmemleak in watchdog_cdev_register {CVE-2023-53234} -…

In the Linux kernel, the following vulnerability has been resolved:

ext4: remove a BUG_ON in ext4_mb_release_group_pa()

If a malicious fuzzer overwrites the ext4 superblock while it is mounted such that the s_first_data_block is set to a very large number, the calculation of the block group can underflow, and trigger a BUG_ON check. Change this to be an ext4_warning so that we don't crash the kernel.