CVE-2023-53323: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53323 is a reachable assertion vulnerability in the Linux kernel's ext2 filesystem DAX (Direct Access) implementation, specifically in the ext2_setsize function when handling page-aligned lengths. When a truncate operation results in a zero-length value being passed to dax_zero_range(), the function incorrectly forwards a zero max_blocks value to ext2_get_blocks(), triggering a BUG_ON(maxblocks == 0) kernel assertion. Affected versions include Linux kernel 5.15 through 6.1.39 and 6.2 through 6.4.4. It was publicly disclosed on September 16, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-617 (Reachable Assertion). The PAGE_ALIGN(x) macro returns x unchanged when x is already page-aligned, so when the offset passed to ext2_setsize is page-aligned and the remaining length is zero, dax_zero_range() is called with a length of 0. This propagates through ext2_iomap_begin() into ext2_get_blocks(), where the assertion BUG_ON(maxblocks == 0) fires. The correct fix is to call dax_truncate_page() instead, which internally checks alignment before invoking dax_zero_range(). The bug is locally exploitable and can be trivially triggered with standard filesystem utilities (dd and truncate) on a DAX-mounted ext2 pmem device (Red Hat Bugzilla).

Successful exploitation causes a kernel BUG (assertion failure), which results in a kernel panic or system crash, leading to a complete loss of availability for the affected system. The impact is limited to availability — there is no confidentiality or integrity impact. An attacker with local access and low privileges can trigger this condition using simple, standard file operations on a DAX-mounted ext2 filesystem (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. However, the triggering condition is trivially reproducible using standard Linux utilities on systems with DAX-mounted ext2 filesystems (Red Hat CVE).

1. Identify a vulnerable target: Locate a system running Linux kernel versions 5.15–6.1.39 or 6.2–6.4.4 with an ext2 filesystem mounted in DAX (fsdax) mode on a persistent memory (pmem) device.
2. Gain local access: Obtain a local shell with low-privilege user access on the target system.
3. Create a non-page-aligned file: Write a small, non-page-aligned file to the DAX-mounted filesystem: dd if=/dev/zero of=/mnt/dax/file count=1 bs=512
4. Trigger the truncation: Run truncate -s 0 /mnt/dax/file to truncate the file to zero bytes, causing ext2_setsize to call dax_zero_range() with a zero length.
5. Kernel panic: The zero length propagates to ext2_get_blocks(), triggering BUG_ON(maxblocks == 0) at fs/ext2/inode.c:637, resulting in a kernel panic and system crash (Red Hat Bugzilla).

• Logs: Kernel log entries containing kernel BUG at fs/ext2/inode.c:637! or invalid opcode: 0000 [#1] PREEMPT SMP PTI in /var/log/kern.log or dmesg output.
• Logs: Call trace in kernel logs referencing ext2_get_blocks.constprop.0, ext2_iomap_begin, dax_zero_range, ext2_setsize, and ext2_setattr.
• Logs: Messages such as EXT2-fs (pmem0): DAX enabled indicating a DAX-mounted ext2 filesystem is in use.
• Process: Unexpected system reboots or kernel panics following truncate operations on DAX-mounted ext2 filesystems (Red Hat Bugzilla).

Update the Linux kernel to a patched version: 6.1.40 or later (for the 6.1.x stable branch) or 6.4.5 or later (for the 6.4.x branch). Patches are available in the upstream stable kernel tree. As a workaround where patching is not immediately possible, avoid mounting ext2 filesystems with the DAX option (-o dax) on persistent memory devices, or restrict local user access to systems using this configuration. SUSE has also issued kernel advisories addressing this CVE (Red Hat CVE, Kernel Patch 1, Kernel Patch 2).