TI-2023-28912 Aliases CVE-2023-52569 GHSA-484w-f535-whcj

btrfs: remove BUG() after failure to insert delayed dir index item

LOW 24CWE-617Published 2024-03-02 · Updated 2026-05-23

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-617.

Summary

In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG() after failure to insert delayed dir index item Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release all the resources we have allocated/acquired before and return the error to the caller. This is fine because all existing call chains undo anything they have done before calling btrfs_insert_delayed_dir_index() or BUG_ON (when creating pending snapshots in the transaction commit path). So remove the BUG() call and do proper error handling. This relates to a syzbot report linked below, but does not fix it because it only prevents hitting a BUG(), it does not fix the issue where somehow we attempt to use twice the same index number for different index items.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00241 15th percentileScored 2026-11-07

Fix Partial Linux (Linux): 5.16, 6.5, 6.5.6 +1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Linux	Linux	5.15.149 to before 5.16; 6.4.12 to before 6.5	5.16, 6.5	Patch available	CNA
Linux	Linux	6.5 and later	6.5.6, 6.6	Patch available	CNA

Linux VendorLinux Affected 5.15.149 to before 5.16; 6.4.12 to before 6.5 Fixed in 5.16, 6.5 Patch available CNA
Linux VendorLinux Affected 6.5 and later Fixed in 6.5.6, 6.6 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:linux:linux_kernel::::::::	before 6.1.56; 6.2 to before 6.5.6	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:6.6:rc1::::::	6.6 rc1	Vulnerable	Linux

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 6.1.56; 6.2 to before 6.5.6 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:* Versions 6.6 rc1 Vulnerable ·Linux

Remediation

Fix · CNA Linux (Linux) Fixed in 5.16, 6.5
Fix · CNA Linux (Linux) Fixed in 6.5.6, 6.6

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope

Not affected: 2 products

Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2023-52569
2026-10-03 Alias added: GHSA-484w-f535-whcj

References

Patch 3

TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3

See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences