linux-cve-announce - CVE-2023-53626: ext4: fix possible double unlock when moving a directory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100711-CVE-2023-53626-24ed@gregkh>
Date: Tue,  7 Oct 2025 17:19:31 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53626: ext4: fix possible double unlock when moving a directory

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix possible double unlock when moving a directory

The Linux kernel CVE team has assigned CVE-2023-53626 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.4.237 with commit 8dac5a63cf79707b547ea3d425fead5f4482198f and fixed in 5.4.238 with commit c16cbd8233d6c58fc488545393e49b5d55729990
	Issue introduced in 5.10.175 with commit 0c440f14558bfacd22c6935ae1fd4b2a09e96b5d and fixed in 5.10.176 with commit 020166bc6669ca9fb267ebd96bd88c4fb64a5d46
	Issue introduced in 5.15.103 with commit c50fc503ee1b97f12c98e26afc39fdaebebcf04f and fixed in 5.15.104 with commit 1c93c42c7bb23057bde8a0a2ab834927ff64d20c
	Issue introduced in 6.1.20 with commit b0bb13612292ca90fa4c2a7e425375649bc50d3e and fixed in 6.1.21 with commit e71eb4dca41f0f36823724ced0406bb2dbdd5506
	Issue introduced in 6.2.7 with commit 291cd19d107e197306869cb3237c1bba62d13182 and fixed in 6.2.8 with commit 43ce288ab5d7274a4a141d7f5e3ed2ab7b41f8a2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53626
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ext4/namei.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c16cbd8233d6c58fc488545393e49b5d55729990
	https://git.kernel.org/stable/c/020166bc6669ca9fb267ebd96bd88c4fb64a5d46
	https://git.kernel.org/stable/c/1c93c42c7bb23057bde8a0a2ab834927ff64d20c
	https://git.kernel.org/stable/c/e71eb4dca41f0f36823724ced0406bb2dbdd5506
	https://git.kernel.org/stable/c/43ce288ab5d7274a4a141d7f5e3ed2ab7b41f8a2
	https://git.kernel.org/stable/c/70e42feab2e20618ddd0cbfc4ab4b08628236ecd