CVE-2023-54021: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54021 is a vulnerability in the Linux kernel's ext4 filesystem subsystem, specifically in the ext4_mb_normalize_request function. The bug involves incorrectly setting the goal start field (ac_f_ex instead of ac_g_ex) used by ext4_mb_find_by_goal, and failing to ensure the goal start is within the valid range [first_data_block, blocks_count). An additional issue allows an underflowed value of ar->pright - size to be passed to ext4_get_group_no_and_offset(), which triggers a BUG_ON and can cause a kernel panic. The CVE was published on December 24, 2025, and affects Linux kernel versions from the initial commit up through multiple stable branches. No official CVSS score has been assigned by NVD at this time; Feedly estimates the severity as Medium (Feedly, ENISA EUVD).

The root cause is an incorrect field assignment in ext4_mb_normalize_request: the code sets ac_f_ex (the found extent) rather than ac_g_ex (the goal extent), causing ext4_mb_find_by_goal to use an incorrect goal block start. Additionally, the function does not validate that the goal start falls within the valid block range [first_data_block, blocks_count), as ext4_mb_initialize_context does. A secondary issue allows an integer underflow when size >= ar->pright, passing a wrapped-around value to ext4_get_group_no_and_offset(), which triggers a BUG_ON assertion and results in a kernel panic. This is a local vulnerability requiring the ability to trigger ext4 block allocation operations (e.g., writing to an ext4-mounted filesystem). No CWE classification has been formally assigned, but the issue is consistent with improper input validation and integer underflow patterns (kernel.org patches).

Successful triggering of this vulnerability causes a kernel BUG_ON assertion failure, resulting in a kernel panic and system crash, impacting availability. The primary impact is a denial of service (DoS) to the affected system. There is no evidence of confidentiality or integrity impact, and no lateral movement potential has been identified for this vulnerability (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-54021. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a system with an ext4 filesystem mounted and the ability to perform file write operations (Feedly).

Patches have been backported to multiple stable Linux kernel branches. Fixed versions include: 4.14.316, 4.19.284, 5.4.244, 5.10.181, 5.15.113, 6.1.30, 6.3.4, and 6.4+. Administrators should update to a patched kernel version for their respective stable branch. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (kernel.org patches, Feedly).