{"cve":"CVE-2023-52748","nvd":{"published":"2024-05-21T16:15:14.517","modified":"2026-06-17T06:43:29.597","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: avoid format-overflow warning\n\nWith gcc and W=1 option, there's a warning like this:\n\nfs/f2fs/compress.c: In function ‘f2fs_init_page_array_cache’:\nfs/f2fs/compress.c:1984:47: error: ‘%u’ directive writing between\n1 and 7 bytes into a region of size between 5 and 8\n[-Werror=format-overflow=]\n 1984 |  sprintf(slab_name, \"f2fs_page_array_entry-%u:%u\", MAJOR(dev),\n\t\tMINOR(dev));\n      |                                               ^~\n\nString \"f2fs_page_array_entry-%u:%u\" can up to 35. The first \"%u\" can up\nto 4 and the second \"%u\" can up to 7, so total size is \"24 + 4 + 7 = 35\".\nslab_name's size should be 35 rather than 32.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-787"],"references":["https://git.kernel.org/stable/c/3eebe636cac53886bd5d1cdd55e082ec9e84983f","https://git.kernel.org/stable/c/526dd7540a09ecf87b5f54f3ab4e0a2528f25a79","https://git.kernel.org/stable/c/6fca08fd3085253b48fcb1bd243a0a5e18821a00","https://git.kernel.org/stable/c/c041f5ddef00c731c541e00bc8ae97b8c84c682f","https://git.kernel.org/stable/c/e0d4e8acb3789c5a8651061fbab62ca24a45c063"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:50:30.954589733+00:00"},"epss":{"cve":"CVE-2023-52748","score":0.00249,"percentile":0.16316,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}