CVE-2023-4273

A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.

CVSS 3.1

6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-25)

CWEs

CWE-787, CWE-121

Published

2023-08-09

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• debian:debian_linux
• fedoraproject:fedora
• linux:linux_kernel
• netapp:h300s_firmware
• netapp:h410s_firmware
• netapp:h500s_firmware
• netapp:h700s_firmware
• redhat:enterprise_linux

References

• https://access.redhat.com/errata/RHSA-2023:6583
• https://access.redhat.com/security/cve/CVE-2023-4273
• https://bugzilla.redhat.com/show_bug.cgi?id=2221609
• https://dfir.ru/2023/08/23/cve-2023-4273-a-vulnerability-in-the-linux-exfat-driver/
• https://access.redhat.com/errata/RHSA-2023:6583

Check your stackJSON