Linux Kernel up to 6.1.38/6.3.12/6.4.3 comparison

Summaryinfo

A vulnerability marked as critical has been reported in Linux Kernel up to 6.1.38/6.3.12/6.4.3. This impacts an unknown function. The manipulation leads to comparison. This vulnerability is listed as CVE-2023-53777. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.1.38/6.3.12/6.4.3 and classified as critical. This issue affects an unknown code. The manipulation with an unknown input leads to a comparison vulnerability. Using CWE to declare the problem leads to CWE-697. The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: erofs: kill hooked chains to avoid loops on deduplicated compressed images After heavily stressing EROFS with several images which include a hand-crafted image of repeated patterns for more than 46 days, I found two chains could be linked with each other almost simultaneously and form a loop so that the entire loop won't be submitted. As a consequence, the corresponding file pages will remain locked forever. It can be _only_ observed on data-deduplicated compressed images. For example, consider two chains with five pclusters in total: Chain 1: 2->3->4->5 -- The tail pcluster is 5; Chain 2: 5->1->2 -- The tail pcluster is 2. Chain 2 could link to Chain 1 with pcluster 5; and Chain 1 could link to Chain 2 at the same time with pcluster 2. Since hooked chains are all linked locklessly now, I have no idea how to simply avoid the race. Instead, let's avoid hooked chains completely until I could work out a proper way to fix this and end users finally tell us that it's needed to add it back. Actually, this optimization can be found with multi-threaded workloads (especially even more often on deduplicated compressed images), yet I'm not sure about the overall system impacts of not having this compared with implementation complexity.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2023-53777 since 12/09/2025. The exploitation is known to be difficult. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/29/2026).

The vulnerability scanner Nessus provides a plugin with the ID 278097 (Linux Distros Unpatched Vulnerability : CVE-2023-53777), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.1.39, 6.3.13 or 6.4.4 eliminates this vulnerability. Applying the patch d3b39ea24835ac03da1a30f93ae7c05d55a40191/b5b0d52f00e4bacb0ebdf47cd7016b0485fffad2/10c2b98a40d9044a3e97f4697ca6213bad7e19c2/967c28b23f6c89bb8eef6a046ea88afe0d7c1029 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (278097) and CERT Bund (WID-SEC-2025-2765). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source Linux Kernel
• RESF Rocky Linux

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 6.1.8
• 6.1.9
• 6.1.10
• 6.1.11
• 6.1.12
• 6.1.13
• 6.1.14
• 6.1.15
• 6.1.16
• 6.1.17
• 6.1.18
• 6.1.19
• 6.1.20
• 6.1.21
• 6.1.22
• 6.1.23
• 6.1.24
• 6.1.25
• 6.1.26
• 6.1.27
• 6.1.28
• 6.1.29
• 6.1.30
• 6.1.31
• 6.1.32
• 6.1.33
• 6.1.34
• 6.1.35
• 6.1.36
• 6.1.37
• 6.1.38
• 6.3.0
• 6.3.1
• 6.3.2
• 6.3.3
• 6.3.4
• 6.3.5
• 6.3.6
• 6.3.7
• 6.3.8
• 6.3.9
• 6.3.10
• 6.3.11
• 6.3.12
• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion