{"id":"DEBIAN-CVE-2023-53101","details":"In the Linux kernel, the following vulnerability has been resolved:  ext4: zero i_disksize when initializing the bootloader inode  If the boot loader inode has never been used before, the EXT4_IOC_SWAP_BOOT inode will initialize it, including setting the i_size to 0.  However, if the \"never before used\" boot loader has a non-zero i_size, then i_disksize will be non-zero, and the inconsistency between i_size and i_disksize can trigger a kernel warning:   WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319  CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa  RIP: 0010:ext4_file_write_iter+0xbc7/0xd10  Call Trace:   vfs_write+0x3b1/0x5c0   ksys_write+0x77/0x160   __x64_sys_write+0x22/0x30   do_syscall_64+0x39/0x80  Reproducer:  1. create corrupted image and mount it:        mke2fs -t ext4 /tmp/foo.img 200        debugfs -wR \"sif \u003c5\u003e size 25700\" /tmp/foo.img        mount -t ext4 /tmp/foo.img /mnt        cd /mnt        echo 123 \u003e file  2. Run the reproducer program:        posix_memalign(&buf, 1024, 1024)        fd = open(\"file\", O_RDWR | O_DIRECT);        ioctl(fd, EXT4_IOC_SWAP_BOOT);        write(fd, buf, 1024);  Fix this by setting i_disksize as well as i_size to zero when initiaizing the boot loader inode.","modified":"2026-09-15T09:02:50.121674320Z","published":"2025-05-02T16:15:29.023Z","upstream":["CVE-2023-53101"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53101"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53101.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53101.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53101.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}