High 7.8Published Dec 8, 2025

CVE-2023-53804nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()

Updated under an hour ago (Oct 26, 2026, 5:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). However, since nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may cause use-after-free read if inodes are left in "garbage_list" and released by nilfs_dispose_list() at the end of nilfs_detach_log_writer(). Fix this issue by modifying nilfs_evict_inode() to only clear inode without additional metadata changes that use nilfs_root if the file system is degraded to read-only or the writer is detached.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e912a5b66837ee89fb025e67b5efeaa11930c2ce before f31e18131ee2ce80a4da5c808221d25b1ae9ad6d; from e912a5b66837ee89fb025e67b5efeaa11930c2ce before 2a782ea8ebd712a458466e3103e2881b4f886cb5; from e912a5b66837ee89fb025e67b5efeaa11930c2ce before 116d53f09ff52e6f98e3fe1f85d8898d6ba26c68; from e912a5b66837ee89fb025e67b5efeaa11930c2ce before 6b4205ea97901f822004e6c8d59484ccfda03faa; from e912a5b66837ee89fb025e67b5efeaa11930c2ce before b8427b8522d9ede53015ba45a9978ba68d1162f5; from e912a5b66837ee89fb025e67b5efeaa11930c2ce before acc2a40e428f12780004e1e9fce4722d88f909fd; from e912a5b66837ee89fb025e67b5efeaa11930c2ce before fb8e8d58f116d069e5939e1f786ac84e7fa4533e; from e912a5b66837ee89fb025e67b5efeaa11930c2ce before 9b5a04ac3ad9898c4745cba46ea26de74ba56a8e	CNA record

References

https://git.kernel.org/stable/c/f31e18131ee2ce80a4da5c808221d25b1ae9ad6d
https://git.kernel.org/stable/c/2a782ea8ebd712a458466e3103e2881b4f886cb5
https://git.kernel.org/stable/c/116d53f09ff52e6f98e3fe1f85d8898d6ba26c68
https://git.kernel.org/stable/c/6b4205ea97901f822004e6c8d59484ccfda03faa
https://git.kernel.org/stable/c/b8427b8522d9ede53015ba45a9978ba68d1162f5
https://git.kernel.org/stable/c/acc2a40e428f12780004e1e9fce4722d88f909fd
https://git.kernel.org/stable/c/fb8e8d58f116d069e5939e1f786ac84e7fa4533e
https://git.kernel.org/stable/c/9b5a04ac3ad9898c4745cba46ea26de74ba56a8e

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.