CVE-2023-53796: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix information leak in f2fs_move_inline_dirents() When converting an inline directory to a regular one, f2fs is leaking uninitialized memory to disk because it doesn't initialize the entire directory block. Fix this by zero-initializing the block. This bug was introduced by commit 4ec17d688d74 ("f2fs: avoid unneeded initializing when converting inline dentry"), which didn't consider the security implications of leaking uninitialized memory to disk. This was found by running xfstest generic/435 on a KMSAN-enabled kernel.

Affected products

• Linux Linux: from 4.3, before 4.14.308 (fixed in 4.14.308); from 4.15, before 4.19.276 (fixed in 4.19.276); from 4.20, before 5.4.235 (fixed in 5.4.235); from 5.5, before 5.10.173 (fixed in 5.10.173); from 5.11, before 5.15.99 (fixed in 5.15.99); from 5.16, before 6.1.16 (fixed in 6.1.16); …

Published 2025-12-09. Last modified 2026-06-17.