CVE-2023-53149

published 2025-09-15

CVE-2023-53149: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid deadlock in fs reclaim with page writeback Ext4 has a filesystem wide lock…

Priority P4 19 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid deadlock in fs reclaim with page writeback

Ext4 has a filesystem wide lock protecting ext4_writepages() calls to
avoid races with switching of journalled data flag or inode format. This
lock can however cause a deadlock like:

CPU0 CPU1

ext4_writepages()
percpu_down_read(sbi->s_writepages_rwsem);
ext4_change_inode_journal_flag()
percpu_down_write(sbi->s_writepages_rwsem);
- blocks, all readers block from now on
ext4_do_writepages()
ext4_init_io_end()
kmem_cache_zalloc(io_end_cachep, GFP_KERNEL)
fs_reclaim frees dentry...
dentry_unlink_inode()
iput() - last ref =>
iput_final() - inode dirty =>
write_inode_now()...
ext4_writepages() tries to acquire sbi->s_writepages_rwsem
and blocks forever

Make sure we cannot recurse into filesystem reclaim from writeback code
to avoid the deadlock.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.3.7-1 (forky)	linux 6.3.7-1 (forky)
linux	linux	—	—
linux	linux	>= c8585c6fcaf2011de54c3592e80a634a2b9e1a7f < 2ec97dc90df40c50e509809dc9a198638a7e18b6	2ec97dc90df40c50e509809dc9a198638a7e18b6
linux	linux	>= c8585c6fcaf2011de54c3592e80a634a2b9e1a7f < 4b4340bf04ce9a52061f15000ecedd126abc093c	4b4340bf04ce9a52061f15000ecedd126abc093c
linux	linux	>= c8585c6fcaf2011de54c3592e80a634a2b9e1a7f < 00d873c17e29cc32d90ca852b82685f1673acaa5	00d873c17e29cc32d90ca852b82685f1673acaa5
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 4.7 < 6.2.16	6.2.16
linux	linux_kernel	>= 6.3 < 6.3.3	6.3.3
msrc	cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0	—	—
msrc	cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0	—	—
msrc	cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0	—	—

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_msrc 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-667 CWE-833