CVE-2023-53260
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-53260
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53260.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-53260
- Downstream
- Related
- Published
- 2025-09-15T14:46:31Z
- Modified
- 2025-10-21T15:28:34.000194Z
- Summary
- ovl: fix null pointer dereference in ovl_permission()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ovl: fix null pointer dereference in ovl_permission()
Following process: P1 P2 pathlookupat linkpathwalk inodepermission ovlpermission ovlipathreal(inode, &realpath) path->dentry = ovlidentryupper(inode) dropcache dentrykill(ovldentry) iput(ovlinode) ovldestroyinode(ovlinode) dput(oi->upperdentry) dentrykill(upperdentry) dentryunlinkinode upperdentry->dinode = NULL realinode = dinode(realpath.dentry) // return NULL inodepermission(realinode) inode->isb // NULL pointer dereference , will trigger an null pointer dereference at realinode: [ 335.664979] BUG: kernel NULL pointer dereference, address: 0000000000000002 [ 335.668032] CPU: 0 PID: 2592 Comm: ls Not tainted 6.3.0 [ 335.669956] RIP: 0010:inodepermission+0x33/0x2c0 [ 335.678939] Call Trace: [ 335.679165] <TASK> [ 335.679371] ovlpermission+0xde/0x320 [ 335.679723] inodepermission+0x15e/0x2c0 [ 335.680090] linkpathwalk+0x115/0x550 [ 335.680771] pathlookupat.isra.0+0xb2/0x200 [ 335.681170] filenamelookup+0xda/0x240 [ 335.681922] vfsstatx+0xa6/0x1f0 [ 335.682233] vfsfstatat+0x7b/0xb0
Fetch a reproducer in [Link].
Use the helper ovlipath_realinode() to get realinode and then do non-nullptr checking.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4b7791b2e95805eaa9568761741d33cf929c930cFixed53dd2ca2c02fdcfe3aad2345091d371063f97d17
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4b7791b2e95805eaa9568761741d33cf929c930cFixed69f9ae7edf9ec0ff500429101923347fcba5c8c4
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4b7791b2e95805eaa9568761741d33cf929c930cFixed1a73f5b8f079fd42a544c1600beface50c63af7c
Affected versions
v5.*
v6.*
Database specific
vanir_signatures
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53dd2ca2c02fdcfe3aad2345091d371063f97d17",
"target": {
"function": "ovl_permission",
"file": "fs/overlayfs/inode.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53260-4dc4f302",
"digest": {
"function_hash": "148123440981662978004032463776134875285",
"length": 640.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53dd2ca2c02fdcfe3aad2345091d371063f97d17",
"target": {
"file": "fs/overlayfs/inode.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53260-70e0d30c",
"digest": {
"line_hashes": [
"170043098391656221847578075928577019098",
"32975670672430431655816707614054643363",
"78444291089231329588542113883064379652",
"276338156773259342743887566345097669685",
"59135680421780167585339442913115207874",
"48566610639837235965534568640102860177",
"300101434056908191329195357824899477136",
"147114574339013249201481558319871741545",
"179810709283614535465416365844180245681"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69f9ae7edf9ec0ff500429101923347fcba5c8c4",
"target": {
"file": "fs/overlayfs/inode.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53260-9c91136c",
"digest": {
"line_hashes": [
"170043098391656221847578075928577019098",
"32975670672430431655816707614054643363",
"78444291089231329588542113883064379652",
"276338156773259342743887566345097669685",
"59135680421780167585339442913115207874",
"195472053211201335602119625530219076278",
"300101434056908191329195357824899477136",
"147114574339013249201481558319871741545",
"179810709283614535465416365844180245681"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69f9ae7edf9ec0ff500429101923347fcba5c8c4",
"target": {
"function": "ovl_permission",
"file": "fs/overlayfs/inode.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53260-9ef3177a",
"digest": {
"function_hash": "292378772158518079693812449969723586094",
"length": 641.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a73f5b8f079fd42a544c1600beface50c63af7c",
"target": {
"file": "fs/overlayfs/inode.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53260-d38df870",
"digest": {
"line_hashes": [
"170043098391656221847578075928577019098",
"32975670672430431655816707614054643363",
"78444291089231329588542113883064379652",
"276338156773259342743887566345097669685",
"59135680421780167585339442913115207874",
"195472053211201335602119625530219076278",
"300101434056908191329195357824899477136",
"147114574339013249201481558319871741545",
"179810709283614535465416365844180245681"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a73f5b8f079fd42a544c1600beface50c63af7c",
"target": {
"function": "ovl_permission",
"file": "fs/overlayfs/inode.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53260-e8e87681",
"digest": {
"function_hash": "292378772158518079693812449969723586094",
"length": 641.0
}
}
]