{"cve":"CVE-2023-54021","nvd":{"published":"2025-12-24T11:15:55.103","modified":"2026-06-17T06:46:33.200","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: set goal start correctly in ext4_mb_normalize_request\n\nWe need to set ac_g_ex to notify the goal start used in\next4_mb_find_by_goal. Set ac_g_ex instead of ac_f_ex in\next4_mb_normalize_request.\nBesides we should assure goal start is in range [first_data_block,\nblocks_count) as ext4_mb_initialize_context does.\n\n[ Added a check to make sure size is less than ar->pright; otherwise\n  we could end up passing an underflowed value of ar->pright - size to\n  ext4_get_group_no_and_offset(), which will trigger a BUG_ON later on.\n  - TYT ]","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/2479bb6cbdb4d56b807bbe5229e3e26a6f1f4530","https://git.kernel.org/stable/c/390eee955d4de4662db5e3e9e9a9eae020432cb7","https://git.kernel.org/stable/c/3ca3005b502ca8ea87d6a344323b179b48c4e4a3","https://git.kernel.org/stable/c/abb330ffaa3a0ae7ce632e28c9260b461c01f19f","https://git.kernel.org/stable/c/b07ffe6927c75d99af534d685282ea188d9f71a6"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:17:07.138532058+00:00"},"epss":{"cve":"CVE-2023-54021","score":0.00196,"percentile":0.09373,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}