Description
An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.3.7-1 | — |
| Debian 13 | linux | 6.3.7-1 | — |
| Debian 12 | linux | 6.1.37-1 | — |
| Debian 10 | linux | 4.19.289-1 | DLA-3508-1 |
| Debian 10 | linux-5.10 | 5.10.197-1~deb10u1 | DLA-3623-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1023.25 | — |
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-83.92 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1044.49 | — |
| Ubuntu 22.04 LTS | linux-aws-6.2 | 6.2.0-1011.11~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1046.53 | — |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1046.53.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1041.49 | — |
| Ubuntu 22.04 LTS | linux-gcp-6.2 | 6.2.0-1013.13~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-gke +1 | 5.15.0-1041.46 | — |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1027.32 | — |
| Ubuntu 22.04 LTS | linux-hwe-6.2 | 6.2.0-32.32~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-ibm +1 | 5.15.0-1037.40 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1039.45 | — |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.2 | 6.2.0-1012.12~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1032.32 | — |
| Ubuntu 22.04 LTS | linux-nvidia-6.2 | 6.2.0-1010.10 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1017.17 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1004.4 | — |
| Ubuntu 22.04 LTS | linux-oem-6.1 | 6.1.0-1014.14 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1042.48 | — |
| Ubuntu 22.04 LTS | linux-riscv +12 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-xilinx-zynqmp | 5.15.0-1025.29 | — |
| Ubuntu 20.04 LTS | linux | 5.4.0-162.179 | — |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1109.118 | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1044.49~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1046.53~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1070.76 | — |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1112.121 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1041.49~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gke +26 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gkeop | 5.4.0-1076.80 | — |
| Ubuntu 20.04 LTS | linux-gkeop-5.15 | 5.15.0-1027.32~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-83.92~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1056.61 | — |
| Ubuntu 20.04 LTS | linux-ibm-5.15 | 5.15.0-1037.40~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1040.46~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1021.22 | — |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1098.104 | — |
| Ubuntu 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1017.17~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1108.117 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1042.48~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1093.104 | — |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1040.44~20.04.3 | — |
| Ubuntu 20.04 LTS | linux-xilinx-zynqmp | 5.4.0-1029.33 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1038.40 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1045.50 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1109.118+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1115.122+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1084.93 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1112.121+fips1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-aws-fips | 4.15.0-2105.111 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-azure-fips | 4.15.0-2084.90 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips | 4.15.0-1121.132 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-gcp-fips | 4.15.0-2068.73 | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | 4.4.0-1099.106 | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux-azure | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux | 4.15.0-223.235 | USN-6701-1 |
| Ubuntu Pro 18.04 LTS | linux-aws | 4.15.0-1166.179 | USN-6701-1 |
| Ubuntu Pro 18.04 LTS | linux-aws-5.4 | 5.4.0-1109.118~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-azure-4.15 | 4.15.0-1175.190 | USN-6701-3 |
| Ubuntu Pro 18.04 LTS | linux-azure-5.4 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux-gcp-4.15 | 4.15.0-1160.177 | USN-6701-2 |
| Ubuntu Pro 18.04 LTS | linux-gcp-5.4 | 5.4.0-1112.121~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-hwe-5.4 | 5.4.0-162.179~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-ibm-5.4 | 5.4.0-1056.61~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-kvm | 4.15.0-1150.155 | USN-6701-1 |
| Ubuntu Pro 18.04 LTS | linux-oracle | 4.15.0-1129.140 | USN-6701-1 |
| Ubuntu Pro 18.04 LTS | linux-oracle-5.4 | 5.4.0-1108.117~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-raspi-5.4 | 5.4.0-1093.104~18.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux | 4.4.0-252.286 | USN-6700-1 |
| Ubuntu Pro 16.04 LTS | linux-aws | 4.4.0-1167.182 | USN-6700-2 |
| Ubuntu Pro 16.04 LTS | linux-aws-hwe | 4.15.0-1166.179~16.04.1 | USN-6701-3 |
| Ubuntu Pro 16.04 LTS | linux-azure | 4.15.0-1175.190~16.04.1 | USN-6701-3 |
| Ubuntu Pro 16.04 LTS | linux-gcp | 4.15.0-1160.177~16.04.1 | USN-6701-2 |
| Ubuntu Pro 16.04 LTS | linux-hwe | 4.15.0-223.235~16.04.1 | USN-6701-1 |
| Ubuntu Pro 16.04 LTS | linux-kvm | 4.4.0-1130.140 | USN-6700-1 |
| Ubuntu Pro 16.04 LTS | linux-oracle | 4.15.0-1129.140~16.04.1 | USN-6701-3 |
| Ubuntu Pro 14.04 LTS | linux | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux-aws | 4.4.0-1129.135 | USN-6700-1 |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1175.190~14.04.1 | USN-6701-4 |
| Ubuntu Pro 14.04 LTS | linux-lts-xenial | 4.4.0-252.286~14.04.1 | USN-6700-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.1.29-47.49 | 1.0-0.amzn2023 | ALAS2023-2023-184 |
| Amazon Linux 2023 | perf +12 | 6.1.29-47.49.amzn2023 | ALAS2023-2023-184 |
| Amazon Linux 2 | kernel-livepatch-4.14.318-240.529 | 1.0-0.amzn2 | ALAS2-2023-2100 |
| Amazon Linux 2 | perf +8 | 4.14.318-240.529.amzn2 | ALAS2-2023-2100 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | kernel | 5.15.116.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | kernel-uek +5 | 4.1.12-124.76.2.el7uek | ELSA-2023-12566 |
Advisories 14
- USN-6701-3 linux-aws-hwe, linux-azure, linux-azure-4.15, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6701-4 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6701-2 linux-gcp, linux-gcp-4.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6700-2 linux-aws vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6701-1 linux, linux-aws, linux-hwe, linux-kvm, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6700-1 linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- DLA-3508-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3623-1 linux-5.10 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ALAS2023-2023-184 Important: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 11, 2026
- ALAS2-2023-2100 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 8, 2026
- WID-SEC-2023-1341 Linux Kernel: Schwachstelle ermöglicht nicht spezifizierten Angriff BSI CERT-Bund (WID) · Apr 9, 2024
- ICSA-24-046-11 Siemens SCALANCE XCM-/XRM-300 CISA ICS & IT advisories · Feb 13, 2024
- SSA-806742 SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 Siemens ProductCERT · Feb 13, 2024
- ELSA-2023-12566 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 4, 2023
References
- https://syzkaller.appspot.com/bug?extid=8785e41224a3afd04321
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f04351888a83e595571de672e0a4a8b74f4fb31
- https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3
- https://bugzilla.suse.com/show_bug.cgi?id=1211895
- [debian-lts-announce] 20230727 [SECURITY] [DLA 3508-1] linux security update mailing-list
- [debian-lts-announce] 20231019 [SECURITY] [DLA 3623-1] linux-5.10 security update mailing-list