CVE-2023-53618
published 2025-10-07CVE-2023-53618: In the Linux kernel, the following vulnerability has been resolved: btrfs: reject invalid reloc tree root keys with stack dump [BUG] Syzbot reported a crash…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.19%
8.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
btrfs: reject invalid reloc tree root keys with stack dump
[BUG]
Syzbot reported a crash that an ASSERT() got triggered inside
prepare_to_merge().
That ASSERT() makes sure the reloc tree is properly pointed back by its
subvolume tree.
[CAUSE]
After more debugging output, it turns out we had an invalid reloc tree:
BTRFS error (device loop1): reloc tree mismatch, root 8 has no reloc root, expect reloc root key (-8, 132, 8) gen 17
Note the above root key is (TREE_RELOC_OBJECTID, ROOT_ITEM,
QUOTA_TREE_OBJECTID), meaning it's a reloc tree for quota tree.
But reloc trees can only exist for subvolumes, as for non-subvolume
trees, we just COW the involved tree block, no need to create a reloc
tree since those tree blocks won't be shared with other trees.
Only subvolumes tree can share tree blocks with other trees (thus they
have BTRFS_ROOT_SHAREABLE flag).
Thus this new debug output proves my previous assumption that corrupted
on-disk data can trigger that ASSERT().
[FIX]
Besides the dedicated fix and the graceful exit, also let tree-checker to
check such root keys, to make sure reloc trees can only exist for subvolumes.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 259ee7754b6793af8bdd77f9ca818bc41cfe9541 < 314135b7bae9618a317874ae195272682cf2d5d4 | 314135b7bae9618a317874ae195272682cf2d5d4 |
| linux | linux | >= 259ee7754b6793af8bdd77f9ca818bc41cfe9541 < 3ae93b316ca4b8b3c33798ef1d210355f2fb9318 | 3ae93b316ca4b8b3c33798ef1d210355f2fb9318 |
| linux | linux | >= 259ee7754b6793af8bdd77f9ca818bc41cfe9541 < 84256e00eeca73c529fc6196e478cc89b8098157 | 84256e00eeca73c529fc6196e478cc89b8098157 |
| linux | linux | >= 259ee7754b6793af8bdd77f9ca818bc41cfe9541 < 6ebcd021c92b8e4b904552e4d87283032100796d | 6ebcd021c92b8e4b904552e4d87283032100796d |
| linux | linux | >= 5.2.19 < 5.3 | 5.3 |
| linux | linux | >= 5.3.4 < 5.4 | 5.4 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 5.16 < 6.1.46 | 6.1.46 |
| linux | linux_kernel | >= 5.2.19 < 5.3 | 5.3 |
| linux | linux_kernel | >= 5.3.4 < 5.15.127 | 5.15.127 |
| linux | linux_kernel | >= 6.2 < 6.4.11 | 6.4.11 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 5.15.126/6.1.45/6.4.10 btrfs assertion (WID-SEC-2025-2229)
vuldb·2026-04-20·CVSS 5.5
CVE-2023-53618 [MEDIUM] Linux Kernel up to 5.15.126/6.1.45/6.4.10 btrfs assertion (WID-SEC-2025-2229)
A vulnerability was found in Linux Kernel up to 5.15.126/6.1.45/6.4.10 and classified as critical. Impacted is an unknown function of the component btrfs. Such manipulation leads to reachable assertion.
This vulnerability is traded as CVE-2023-53618. Access to the local network is required for this attack to succeed. There is no exploit available.
It is suggested to upgrade the affected component.
OSV
CVE-2023-53618: In the Linux kernel, the following vulnerability has been resolved: btrfs: reject invalid reloc tree root keys with stack dump [BUG] Syzbot reported a
osv·2025-10-07·CVSS 5.5
CVE-2023-53618 [MEDIUM] CVE-2023-53618: In the Linux kernel, the following vulnerability has been resolved: btrfs: reject invalid reloc tree root keys with stack dump [BUG] Syzbot reported a
In the Linux kernel, the following vulnerability has been resolved: btrfs: reject invalid reloc tree root keys with stack dump [BUG] Syzbot reported a crash that an ASSERT() got triggered inside prepare_to_merge(). That ASSERT() makes sure the reloc tree is properly pointed back by its subvolume tree. [CAUSE] After more debugging output, it turns out we had an invalid reloc tree: BTRFS error (device loop1): reloc tree mismatch, root 8 has no reloc root, expect reloc root key (-8, 132, 8) gen 17 Note the above root key is (TREE_RELOC_OBJECTID, ROOT_ITEM, QUOTA_TREE_OBJECTID), meaning it's a reloc tree for quota tree. But reloc trees can only exist for subvolumes, as for non-subvolume trees, we just COW the involved tree block, no need to create a reloc tree since those tree blocks won't be
GHSA
GHSA-2244-8r8j-955v: In the Linux kernel, the following vulnerability has been resolved:
btrfs: reject invalid reloc tree root keys with stack dump
[BUG]
Syzbot reported
ghsa_unreviewed·2025-10-07
CVE-2023-53618 [MEDIUM] GHSA-2244-8r8j-955v: In the Linux kernel, the following vulnerability has been resolved:
btrfs: reject invalid reloc tree root keys with stack dump
[BUG]
Syzbot reported
In the Linux kernel, the following vulnerability has been resolved:
btrfs: reject invalid reloc tree root keys with stack dump
[BUG]
Syzbot reported a crash that an ASSERT() got triggered inside
prepare_to_merge().
That ASSERT() makes sure the reloc tree is properly pointed back by its
subvolume tree.
[CAUSE]
After more debugging output, it turns out we had an invalid reloc tree:
BTRFS error (device loop1): reloc tree mismatch, root 8 has no reloc root, expect reloc root key (-8, 132, 8) gen 17
Note the above root key is (TREE_RELOC_OBJECTID, ROOT_ITEM,
QUOTA_TREE_OBJECTID), meaning it's a reloc tree for quota tree.
But reloc trees can only exist for subvolumes, as for non-subvolume
trees, we just COW the involved tree block, no need to create a reloc
tree since those tree blocks wo
Red Hat
kernel: btrfs: reject invalid reloc tree root keys with stack dump
vendor_redhat·2025-10-07·CVSS 5.5
CVE-2023-53618 [MEDIUM] kernel: btrfs: reject invalid reloc tree root keys with stack dump
kernel: btrfs: reject invalid reloc tree root keys with stack dump
In the Linux kernel, the following vulnerability has been resolved:
btrfs: reject invalid reloc tree root keys with stack dump
[BUG]
Syzbot reported a crash that an ASSERT() got triggered inside
prepare_to_merge().
That ASSERT() makes sure the reloc tree is properly pointed back by its
subvolume tree.
[CAUSE]
After more debugging output, it turns out we had an invalid reloc tree:
BTRFS error (device loop1): reloc tree mismatch, root 8 has no reloc root, expect reloc root key (-8, 132, 8) gen 17
Note the above root key is (TREE_RELOC_OBJECTID, ROOT_ITEM,
QUOTA_TREE_OBJECTID), meaning it's a reloc tree for quota tree.
But reloc trees can only exist for subvolumes, as for non-subvolume
trees, we just COW the involved tree blo
Debian
CVE-2023-53618: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: reje...
vendor_debian·2023·CVSS 5.5
CVE-2023-53618 [MEDIUM] CVE-2023-53618: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: reje...
In the Linux kernel, the following vulnerability has been resolved: btrfs: reject invalid reloc tree root keys with stack dump [BUG] Syzbot reported a crash that an ASSERT() got triggered inside prepare_to_merge(). That ASSERT() makes sure the reloc tree is properly pointed back by its subvolume tree. [CAUSE] After more debugging output, it turns out we had an invalid reloc tree: BTRFS error (device loop1): reloc tree mismatch, root 8 has no reloc root, expect reloc root key (-8, 132, 8) gen 17 Note the above root key is (TREE_RELOC_OBJECTID, ROOT_ITEM, QUOTA_TREE_OBJECTID), meaning it's a reloc tree for quota tree. But reloc trees can only exist for subvolumes, as for non-subvolume trees, we just COW the involved tree block, no need to create a reloc tree since those tree blocks won't be
No detection rules found.
No public exploits indexed.
2025-10-07
Published