CVE-2023-53845: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53845 is a vulnerability in the Linux kernel's nilfs2 filesystem driver that causes an infinite loop in the nilfs_mdt_get_block() function when a corrupted disk image is mounted. When a virtual block address obtained during metadata file block lookup is invalid, nilfs_bmap_lookup_at_level() may return -ENOENT — the same code used to indicate a block simply doesn't exist — creating an ambiguity that causes nilfs_mdt_get_block() to loop indefinitely attempting to read and create a metadata block. The vulnerability was published on December 9, 2025, and affects the Linux kernel across multiple stable branches. Feedly estimates this as a Medium severity issue with an EPSS score of 0.00033 (Feedly).

The root cause is an improper error code handling issue (related to CWE-835: Loop with Unreachable Exit Condition) in the nilfs2 filesystem subsystem. When a corrupted disk image causes nilfs_bmap_lookup_at_level() to fail during virtual block address translation, it returns -ENOENT, which is the same code used to signal a legitimately absent block. This ambiguity causes nilfs_mdt_get_block() to misinterpret a corruption error as a missing block and repeatedly attempt to read and then create the block, resulting in an infinite loop. If this occurs in the inode metadata file (ifile), the semaphore i_rwsem can be left held, causing task hangs in lock_mount. The fix changes nilfs_bmap_lookup_at_level() to treat virtual block address translation failures with -ENOENT as metadata corruption rather than returning the ambiguous error code (Feedly, Kernel Git).

Successful triggering of this vulnerability results in a denial of service condition: the affected kernel task enters an infinite loop and, in the case of the inode metadata file (ifile), leaves the i_rwsem semaphore held, causing subsequent tasks to hang indefinitely in lock_mount. This impacts system availability by potentially rendering the filesystem and related kernel threads unresponsive. There is no evidence of confidentiality or integrity impact beyond the availability disruption caused by the kernel hang (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include kernel 4.14.315, 4.19.283, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. Users should update to the patched kernel version applicable to their distribution. As a workaround, systems that do not require nilfs2 support can blacklist or disable the nilfs2 kernel module (modprobe -r nilfs2 or adding blacklist nilfs2 to /etc/modprobe.d/) to prevent exposure (Feedly, Kernel Git).