In the Linux kernel, the following vulnerability has been resolved: btrfs: output extra debug info if we failed to find an inline backref [BUG] Syzbot reported several warning triggered inside lookup_inline_extent_backref(). [CAUSE] As usual, the reproducer doesn't reliably trigger locally here, but at least we know the WARN_ON() is triggered when an inline backref can not be found, and it can only be triggered when @insert is true. (I.e. inserting a new inline backref, which means the backref should already exist) [ENHANCEMENT] After the WARN_ON(), dump all the parameters and the extent tree leaf to help debug.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/28062cd6eda04035d8f6ded2001292ac8b496149 cve-icon cve-icon
https://git.kernel.org/stable/c/376b41524b71e494514720bd6114325b0a2ed19c cve-icon cve-icon
https://git.kernel.org/stable/c/400e08a16604b534fdd82c5a288fa150d04f5f79 cve-icon cve-icon
https://git.kernel.org/stable/c/6994f806c6d1ae8b59344d3700358547f3b3fe1d cve-icon cve-icon
https://git.kernel.org/stable/c/7afbfde45d665953b4d5a42a721e15bf0315d89b cve-icon cve-icon
https://git.kernel.org/stable/c/7f72f50547b7af4ddf985b07fc56600a4deba281 cve-icon cve-icon
https://git.kernel.org/stable/c/b7c3cf2f6c42e6688b1c37215a0b1663f982f915 cve-icon cve-icon
https://git.kernel.org/stable/c/e70ba449b04b40584bdabb383d10455397cbf177 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025100706-CVE-2023-53672-cfad@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-53672 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-53672 cve-icon
History

Wed, 08 Oct 2025 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Wed, 08 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Tue, 07 Oct 2025 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: btrfs: output extra debug info if we failed to find an inline backref [BUG] Syzbot reported several warning triggered inside lookup_inline_extent_backref(). [CAUSE] As usual, the reproducer doesn't reliably trigger locally here, but at least we know the WARN_ON() is triggered when an inline backref can not be found, and it can only be triggered when @insert is true. (I.e. inserting a new inline backref, which means the backref should already exist) [ENHANCEMENT] After the WARN_ON(), dump all the parameters and the extent tree leaf to help debug.
Title btrfs: output extra debug info if we failed to find an inline backref
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-10-07T15:21:28.975Z

Reserved: 2025-10-07T15:16:59.663Z

Link: CVE-2023-53672

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-07T16:15:51.123

Modified: 2025-10-08T19:38:09.863

Link: CVE-2023-53672

cve-icon Redhat

Severity : Low

Publid Date: 2025-10-07T00:00:00Z

Links: CVE-2023-53672 - Bugzilla