CVE-2023-54305: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54305 is a NULL pointer dereference vulnerability in the Linux kernel's ext4 filesystem subsystem. The flaw occurs when an extended attribute (ea) block expansion attempts to access s_root, which has already been set to NULL during an unmount (umount) operation, resulting in a kernel panic. It affects the Linux kernel across multiple stable branches and was published on December 30, 2025. The CVSS base score is 0.0 as currently assessed by ENISA, and the EPSS score is approximately 0.024% — indicating very low exploitation probability (Feedly, EUVD).

The root cause is a NULL pointer dereference (CWE-476) in the ext4 filesystem driver. During an unmount sequence, the superblock's s_root field is set to NULL; however, a concurrent or racing ea (extended attribute) block expansion operation can still attempt to dereference s_root, triggering a kernel panic. The fix adds a guard to refuse ea block creation when the filesystem is in the process of being unmounted. Patches were applied across multiple stable kernel trees, with commits targeting kernel versions 4.14, 4.19, 5.4, 5.10, 5.15, 6.1, 6.2, and 6.3 (Feedly, EUVD).

Successful triggering of this vulnerability causes a kernel panic (system crash), resulting in a denial of service (DoS) for the affected host. There is no evidence of confidentiality or integrity impact — the vulnerability does not enable code execution or data exfiltration. The impact is limited to availability of systems running vulnerable Linux kernel versions with ext4 filesystems, particularly in scenarios where unmount and extended attribute operations occur concurrently (Feedly).

Apply the upstream kernel patches that add a guard refusing ea block creation when the filesystem is unmounted. Fixed versions include Linux kernel stable releases: 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. Users should update to a patched kernel version provided by their Linux distribution. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (EUVD, Feedly).