{"id":"DEBIAN-CVE-2023-53328","details":"In the Linux kernel, the following vulnerability has been resolved:  fs/ntfs3: Enhance sanity check while generating attr_list  ni_create_attr_list uses WARN_ON to catch error cases while generating attribute list, which only prints out stack trace and may not be enough. This repalces them with more proper error handling flow.  [   59.666332] BUG: kernel NULL pointer dereference, address: 000000000000000e [   59.673268] #PF: supervisor read access in kernel mode [   59.678354] #PF: error_code(0x0000) - not-present page [   59.682831] PGD 8000000005ff1067 P4D 8000000005ff1067 PUD 7dee067 PMD 0 [   59.688556] Oops: 0000 [#1] PREEMPT SMP KASAN PTI [   59.692642] CPU: 0 PID: 198 Comm: poc Tainted: G    B   W          6.2.0-rc1+ #4 [   59.698868] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [   59.708795] RIP: 0010:ni_create_attr_list+0x505/0x860 [   59.713657] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8 [   59.731559] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282 [   59.735691] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe [   59.741792] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0 [   59.748423] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9 [   59.754654] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180 [   59.761552] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050 [   59.768323] FS:  00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000 [   59.776027] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [   59.781395] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0 [   59.787607] Call Trace: [   59.790271]  \u003cTASK\u003e [   59.792488]  ? __pfx_ni_create_attr_list+0x10/0x10 [   59.797235]  ? kernel_text_address+0xd3/0xe0 [   59.800856]  ? unwind_get_return_address+0x3e/0x60 [   59.805101]  ? __kasan_check_write+0x18/0x20 [   59.809296]  ? preempt_count_sub+0x1c/0xd0 [   59.813421]  ni_ins_attr_ext+0x52c/0x5c0 [   59.817034]  ? __pfx_ni_ins_attr_ext+0x10/0x10 [   59.821926]  ? __vfs_setxattr+0x121/0x170 [   59.825718]  ? __vfs_setxattr_noperm+0x97/0x300 [   59.829562]  ? __vfs_setxattr_locked+0x145/0x170 [   59.833987]  ? vfs_setxattr+0x137/0x2a0 [   59.836732]  ? do_setxattr+0xce/0x150 [   59.839807]  ? setxattr+0x126/0x140 [   59.842353]  ? path_setxattr+0x164/0x180 [   59.845275]  ? __x64_sys_setxattr+0x71/0x90 [   59.848838]  ? do_syscall_64+0x3f/0x90 [   59.851898]  ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [   59.857046]  ? stack_depot_save+0x17/0x20 [   59.860299]  ni_insert_attr+0x1ba/0x420 [   59.863104]  ? __pfx_ni_insert_attr+0x10/0x10 [   59.867069]  ? preempt_count_sub+0x1c/0xd0 [   59.869897]  ? _raw_spin_unlock_irqrestore+0x2b/0x50 [   59.874088]  ? __create_object+0x3ae/0x5d0 [   59.877865]  ni_insert_resident+0xc4/0x1c0 [   59.881430]  ? __pfx_ni_insert_resident+0x10/0x10 [   59.886355]  ? kasan_save_alloc_info+0x1f/0x30 [   59.891117]  ? __kasan_kmalloc+0x8b/0xa0 [   59.894383]  ntfs_set_ea+0x90d/0xbf0 [   59.897703]  ? __pfx_ntfs_set_ea+0x10/0x10 [   59.901011]  ? kernel_text_address+0xd3/0xe0 [   59.905308]  ? __kernel_text_address+0x16/0x50 [   59.909811]  ? unwind_get_return_address+0x3e/0x60 [   59.914898]  ? __pfx_stack_trace_consume_entry+0x10/0x10 [   59.920250]  ? arch_stack_walk+0xa2/0x100 [   59.924560]  ? filter_irq_stacks+0x27/0x80 [   59.928722]  ntfs_setxattr+0x405/0x440 [   59.932512]  ? __pfx_ntfs_setxattr+0x10/0x10 [   59.936634]  ? kvmalloc_node+0x2d/0x120 [   59.940378]  ? kasan_save_stack+0x41/0x60 [   59.943870]  ? kasan_save_stack+0x2a/0x60 [   59.947719]  ? kasan_set_track+0x29/0x40 [   59.951417]  ? kasan_save_alloc_info+0x1f/0x30 [   59.955733]  ? __kasan_kmalloc+0x8b/0xa0 [   59.959598]  ? __kmalloc_node+0x68/0x150 [   59.963163]  ? kvmalloc_node+0x2d/0x120 [   59.966490]  ? vmemdup_user+0x2b/0xa0 ---truncated---","modified":"2026-09-15T09:02:50.972087713Z","published":"2025-09-16T17:15:39.053Z","upstream":["CVE-2023-53328"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53328"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.52-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53328.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53328.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53328.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}