---
id: CVE-2023-53165
title: 'udf: Fix uninitialized array access for some pathnames'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  udf: Fix uninitialized array access for some pathnames

  For filenames that begin with . and are between 2 and 5 characters long,
  UDF charset conversion code would read …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb <
    008ae78d1e12efa904dc819b1ec83e2bca6b2c56
  - >-
    Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb <
    b37f998d357102e8eb0f8eeb33f03fff22e49cbf
  - >-
    Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb <
    3f1368af47acf4d0b2a5fb0d2c0d6919d2234b6d
  - >-
    Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb <
    4503f6fc95d6dee85fb2c54785848799e192c51c
  - >-
    Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb <
    985f9666698960dfc87a106d6314203fa90fda75
  - >-
    Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb <
    a6824149809395dfbb5bc36bc7057cc3cb84e56d
  - >-
    Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb <
    4d50988da0db167aed6f38685145cb5cd526c4f8
  - >-
    Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb <
    028f6055c912588e6f72722d89c30b401bbcf013
  - Linux 4.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:19:19.480556Z'
published: '2025-09-15'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:21:05.574Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53165'
references:
  - url: 'https://git.kernel.org/stable/c/008ae78d1e12efa904dc819b1ec83e2bca6b2c56'
  - url: 'https://git.kernel.org/stable/c/b37f998d357102e8eb0f8eeb33f03fff22e49cbf'
  - url: 'https://git.kernel.org/stable/c/3f1368af47acf4d0b2a5fb0d2c0d6919d2234b6d'
  - url: 'https://git.kernel.org/stable/c/4503f6fc95d6dee85fb2c54785848799e192c51c'
  - url: 'https://git.kernel.org/stable/c/985f9666698960dfc87a106d6314203fa90fda75'
  - url: 'https://git.kernel.org/stable/c/a6824149809395dfbb5bc36bc7057cc3cb84e56d'
  - url: 'https://git.kernel.org/stable/c/4d50988da0db167aed6f38685145cb5cd526c4f8'
  - url: 'https://git.kernel.org/stable/c/028f6055c912588e6f72722d89c30b401bbcf013'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.0515
ingestedAt: '2026-11-05T22:38:31.783Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

udf: Fix uninitialized array access for some pathnames

For filenames that begin with . and are between 2 and 5 characters long,
UDF charset conversion code would read uninitialized memory in the
output buffer. The only practical impact is that the name may be prepended a
"unification hash" when it is not actually needed but still it is good
to fix this.

## Affected

- `Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb < 008ae78d1e12efa904dc819b1ec83e2bca6b2c56`
- `Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb < b37f998d357102e8eb0f8eeb33f03fff22e49cbf`
- `Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb < 3f1368af47acf4d0b2a5fb0d2c0d6919d2234b6d`
- `Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb < 4503f6fc95d6dee85fb2c54785848799e192c51c`
- `Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb < 985f9666698960dfc87a106d6314203fa90fda75`
- `Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb < a6824149809395dfbb5bc36bc7057cc3cb84e56d`
- `Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb < 4d50988da0db167aed6f38685145cb5cd526c4f8`
- `Linux >= 484a10f49387e4386bf2708532e75bf78ffea2cb < 028f6055c912588e6f72722d89c30b401bbcf013`
- `Linux 4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.