CVE-2023-53618
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-07

Last updated on: 2026-02-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: reject invalid reloc tree root keys with stack dump [BUG] Syzbot reported a crash that an ASSERT() got triggered inside prepare_to_merge(). That ASSERT() makes sure the reloc tree is properly pointed back by its subvolume tree. [CAUSE] After more debugging output, it turns out we had an invalid reloc tree: BTRFS error (device loop1): reloc tree mismatch, root 8 has no reloc root, expect reloc root key (-8, 132, 8) gen 17 Note the above root key is (TREE_RELOC_OBJECTID, ROOT_ITEM, QUOTA_TREE_OBJECTID), meaning it's a reloc tree for quota tree. But reloc trees can only exist for subvolumes, as for non-subvolume trees, we just COW the involved tree block, no need to create a reloc tree since those tree blocks won't be shared with other trees. Only subvolumes tree can share tree blocks with other trees (thus they have BTRFS_ROOT_SHAREABLE flag). Thus this new debug output proves my previous assumption that corrupted on-disk data can trigger that ASSERT(). [FIX] Besides the dedicated fix and the graceful exit, also let tree-checker to check such root keys, to make sure reloc trees can only exist for subvolumes.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-07
Last Modified
2026-02-05
Generated
2026-06-16
AI Q&A
2025-10-07
EPSS Evaluated
2026-06-15
NVD
CVE-2023-53618
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.5
linux linux_kernel From 5.15.160 (inc) to 5.16 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's Btrfs filesystem involves an invalid reloc tree root key that causes an assertion failure (crash) inside the prepare_to_merge() function. The issue arises because reloc trees are only valid for subvolumes, which can share tree blocks with other trees, but the bug allowed invalid reloc tree keys for non-subvolume trees, leading to corrupted on-disk data and a triggered ASSERT(). The fix ensures that reloc trees can only exist for subvolumes and adds checks to prevent such invalid keys.

Impact Analysis

This vulnerability can cause the Linux kernel to crash due to an assertion failure when handling corrupted or invalid Btrfs reloc tree root keys. This can lead to system instability or data loss if the filesystem encounters such corrupted data, potentially affecting system availability and data integrity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-53618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart