CVE-2023-53777: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53777 is a vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) subsystem involving a race condition that causes pcluster chain loops on data-deduplicated compressed images. The flaw was discovered after extensive stress testing (over 46 days) and disclosed on December 9, 2025. It affects Linux kernel versions starting from commit 267f2492c8f7, with fixes backported to stable releases including 6.1.39, 6.3.13, 6.4.4, and 6.5. The CVSS base score is estimated as Medium (exact score not yet assigned by NVD), and the EPSS score is approximately 0.018% (Feedly, ENISA EUVD).

The root cause is a race condition (CWE-362) in the EROFS filesystem's lockless pcluster chain-linking mechanism. When two chains of pclusters are processed concurrently on a data-deduplicated compressed image, they can simultaneously link to each other — for example, Chain 1 (2→3→4→5) links to Chain 2 (5→1→2) via pcluster 5, while Chain 2 simultaneously links back to Chain 1 via pcluster 2 — forming a circular dependency. Because hooked chains are linked locklessly, there is no straightforward synchronization mechanism to prevent this loop. The fix eliminates hooked chain optimization entirely to avoid the race until a proper solution can be implemented (Feedly, ENISA EUVD).

When the circular chain loop forms, the affected file pages remain locked indefinitely, resulting in a denial-of-service condition where processes waiting on those pages hang permanently. This impacts availability of the filesystem and any workloads accessing files on the affected EROFS image. The vulnerability is limited to systems mounting data-deduplicated compressed EROFS images and is more likely to manifest under multi-threaded workloads (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2023-53777. The vulnerability requires a specific precondition — the system must be mounting a data-deduplicated compressed EROFS image — and the race condition is difficult to trigger reliably, as it was only observed after 46+ days of heavy stress testing. The EPSS score is very low at 0.018%, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus plugin 278097 has been released to detect affected systems (Feedly, Tenable).

The Linux kernel maintainers have resolved this issue by disabling the hooked chain optimization in EROFS. Fixes have been backported to stable kernel versions 6.1.39, 6.3.13, 6.4.4, and 6.5. Users should update to a patched kernel version; SUSE has also released advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1) incorporating the fix. As a workaround, avoiding the use of data-deduplicated compressed EROFS images on unpatched systems will prevent exposure (Feedly, Linux Security SUSE Advisory).