CVE-2023-53506

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

udf: Do not bother merging very long extents

When merging very long extents we try to push as much length as possible to the first extent. However this is unnecessarily complicated and not really worth the trouble. Furthermore there was a bug in the logic resulting in corrupting extents in the file as syzbot reproducer shows. So just don't bother with the merging of extents that are too long together.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
LinuxLinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < d52252a1de4cf96a34f722b0cd8902d8ff78eb57; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 5d029799d381a9ee06209a222cae75f04c5d5304; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3d20e3b768aff32112bdce8d3219d923ae75f9f1; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 965982feb333aefa9256c0fe188b5f1b958aef63; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 9a8d602f0723586e668bae7e65c832ceb9bcc8bc; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < adac9ac6d2e04ea0782b91a00ba10706002f3ec4; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 7a965da79f2d22601f329cbfce588386b0847544; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 53cafe1d6d8ef9f93318e5bfccc0d24f27d41ced
LinuxLinux2.6.12

References

Timeline

Published
Oct 1, 2025
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-535077.8In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister devlink params in case interface is down CurrentlCVE-2023-535087.8In the Linux kernel, the following vulnerability has been resolved: ublk: fail to start device if queue setup is interrupted In ublk_ctrl_CVE-2023-535095.5In the Linux kernel, the following vulnerability has been resolved: qed: allow sleep in qed_mcp_trace_dump() By default, qed_mcp_cmd_and_uCVE-2023-53515.4Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1.CVE-2023-535107.8In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix handling of lrbp->cmd ufshcd_queuecommand() may bCVE-2023-535115.5In the Linux kernel, the following vulnerability has been resolved: io_uring: fix fget leak when fs don't support nowait buffered read HemCVE-2023-535125.5In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix a memory leak Add a forgotten kfree().CVE-2023-535135.5In the Linux kernel, the following vulnerability has been resolved: nbd: fix incomplete validation of ioctl arg We tested and found an alaCVE-2023-535145.5In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix memory leak of device names The device names allocateCVE-2023-535157.8In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: don't break lifecycle of vm_dev vm_dev has a separate lifCVE-2023-535167.8In the Linux kernel, the following vulnerability has been resolved: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF The previCVE-2023-535175.5In the Linux kernel, the following vulnerability has been resolved: tipc: do not update mtu if msg_max is too small in mtu negotiation Whe
CVE-2023-53506: High severity, CVSS 7.8 | Vulnix