CVE-2023-53988
Unknown Unknown - Not Provided

Slab-Out-of-Bounds Read in Linux Kernel NTFS3 Causes Kernel Panic

Publication date: 2025-12-24

Last updated on: 2025-12-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() Here is a BUG report from syzbot: BUG: KASAN: slab-out-of-bounds in hdr_delete_de+0xe0/0x150 fs/ntfs3/index.c:806 Read of size 16842960 at addr ffff888079cc0600 by task syz-executor934/3631 Call Trace: memmove+0x25/0x60 mm/kasan/shadow.c:54 hdr_delete_de+0xe0/0x150 fs/ntfs3/index.c:806 indx_delete_entry+0x74f/0x3670 fs/ntfs3/index.c:2193 ni_remove_name+0x27a/0x980 fs/ntfs3/frecord.c:2910 ntfs_unlink_inode+0x3d4/0x720 fs/ntfs3/inode.c:1712 ntfs_rename+0x41a/0xcb0 fs/ntfs3/namei.c:276 Before using the meta-data in struct INDEX_HDR, we need to check index header valid or not. Otherwise, the corruptedi (or malicious) fs image can cause out-of-bounds access which could make kernel panic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-12-24
Last Modified
2025-12-24
Generated
2026-07-06
AI Q&A
2025-12-24
EPSS Evaluated
2026-07-05
NVD
CVE-2023-53988
EUVD
EUVD-2025-205153

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the fs/ntfs3 slab-out-of-bounds read issue in hdr_delete_de() has been fixed. Avoid using corrupted or malicious NTFS file system images that could trigger the out-of-bounds access and cause kernel panic.

Executive Summary

This vulnerability is a slab-out-of-bounds read in the Linux kernel's NTFS3 filesystem driver, specifically in the function hdr_delete_de(). It occurs because the code does not properly validate the index header metadata before using it, which can lead to out-of-bounds memory access when processing a corrupted or malicious NTFS filesystem image. This can cause a kernel panic.

Impact Analysis

This vulnerability can cause a kernel panic, which means the system could crash unexpectedly. This could lead to denial of service or instability on systems using the affected NTFS3 filesystem driver in the Linux kernel, especially if they process corrupted or malicious NTFS filesystem images.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-53988. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart