CVE-2023-53144
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
02/05/2025
Last modified:
10/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms<br />
<br />
As the call trace shown, the root cause is kunmap incorrect pages:<br />
<br />
BUG: kernel NULL pointer dereference, address: 00000000<br />
CPU: 1 PID: 40 Comm: kworker/u5:0 Not tainted 6.2.0-rc5 #4<br />
Workqueue: erofs_worker z_erofs_decompressqueue_work<br />
EIP: z_erofs_lzma_decompress+0x34b/0x8ac<br />
z_erofs_decompress+0x12/0x14<br />
z_erofs_decompress_queue+0x7e7/0xb1c<br />
z_erofs_decompressqueue_work+0x32/0x60<br />
process_one_work+0x24b/0x4d8<br />
? process_one_work+0x1a4/0x4d8<br />
worker_thread+0x14c/0x3fc<br />
kthread+0xe6/0x10c<br />
? rescuer_thread+0x358/0x358<br />
? kthread_complete_and_exit+0x18/0x18<br />
ret_from_fork+0x1c/0x28<br />
---[ end trace 0000000000000000 ]---<br />
<br />
The bug is trivial and should be fixed now. It has no impact on<br />
!HIGHMEM platforms.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.1.20 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.2.7 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



