{
  "threat_severity" : "Moderate",
  "public_date" : "2025-09-15T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: ovl: fix null pointer dereference in ovl_permission()",
    "id" : "2395374",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2395374"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-476",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\novl: fix null pointer dereference in ovl_permission()\nFollowing process:\nP1                     P2\npath_lookupat\nlink_path_walk\ninode_permission\novl_permission\novl_i_path_real(inode, &realpath)\npath->dentry = ovl_i_dentry_upper(inode)\ndrop_cache\n__dentry_kill(ovl_dentry)\niput(ovl_inode)\novl_destroy_inode(ovl_inode)\ndput(oi->__upperdentry)\ndentry_kill(upperdentry)\ndentry_unlink_inode\nupperdentry->d_inode = NULL\nrealinode = d_inode(realpath.dentry) // return NULL\ninode_permission(realinode)\ninode->i_sb  // NULL pointer dereference\n, will trigger an null pointer dereference at realinode:\n[  335.664979] BUG: kernel NULL pointer dereference,\naddress: 0000000000000002\n[  335.668032] CPU: 0 PID: 2592 Comm: ls Not tainted 6.3.0\n[  335.669956] RIP: 0010:inode_permission+0x33/0x2c0\n[  335.678939] Call Trace:\n[  335.679165]  <TASK>\n[  335.679371]  ovl_permission+0xde/0x320\n[  335.679723]  inode_permission+0x15e/0x2c0\n[  335.680090]  link_path_walk+0x115/0x550\n[  335.680771]  path_lookupat.isra.0+0xb2/0x200\n[  335.681170]  filename_lookup+0xda/0x240\n[  335.681922]  vfs_statx+0xa6/0x1f0\n[  335.682233]  vfs_fstatat+0x7b/0xb0\nFetch a reproducer in [Link].\nUse the helper ovl_i_path_realinode() to get realinode and then do\nnon-nullptr checking." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-05-13T00:00:00Z",
    "advisory" : "RHSA-2025:6966",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-570.12.1.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-05-13T00:00:00Z",
    "advisory" : "RHSA-2025:6966",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-570.12.1.el9_6"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-53260\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53260\nhttps://lore.kernel.org/linux-cve-announce/2025091504-CVE-2023-53260-2323@gregkh/T" ],
  "name" : "CVE-2023-53260",
  "csaw" : false
}