CVE-2023-53144 erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms
A null pointer dereference in the Linux kernel's EROFS LZMA decompression on HIGHMEM platforms can cause a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53144?
CVE-2023-53144 is a medium-severity vulnerability in Linux kernel, published on 2 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms
As the call trace shown, the root cause is kunmap incorrect pages:
BUG: kernel NULL pointer dereference, address: 00000000 CPU: 1 PID: 40 Comm: kworker/u5:0 Not tainted 6.2.0-rc5 #4 Workqueue: erofs_worker z_erofs_decompressqueue_work EIP: z_erofs_lzma_decompress+0x34b/0x8ac z_erofs_decompress+0x12/0x14 z_erofs_decompress_queue+0x7e7/0xb1c z_erofs_decompressqueue_work+0x32/0x60 process_one_work+0x24b/0x4d8 ? process_one_work+0x1a4/0x4d8 worker_thread+0x14c/0x3fc kthread+0xe6/0x10c ? rescuer_thread+0x358/0x358 ? kthread_complete_and_exit+0x18/0x18 ret_from_fork+0x1c/0x28 ---[ end trace 0000000000000000 ]---
The bug is trivial and should be fixed now. It has no impact on !HIGHMEM platforms.
Weakness: CWE-476
Which versions are affected by CVE-2023-53144?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53144?
Apply the vendor's patch.
Is CVE-2023-53144 being exploited?
There is no known exploitation of CVE-2023-53144 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53144, DEBIAN-CVE-2023-53144, GHSA-v7hq-jrg2-9x5f, UBUNTU-CVE-2023-53144.