Vulnerability-Lookup

CVE-2023-53526 (GCVE-0-2023-53526)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:46 – Updated: 2026-08-05 09:14

Title

jbd2: check 'jh->b_transaction' before removing it from checkpoint

Summary

In the Linux kernel, the following vulnerability has been resolved: jbd2: check 'jh->b_transaction' before removing it from checkpoint Following process will corrupt ext4 image: Step 1: jbd2_journal_commit_transaction __jbd2_journal_insert_checkpoint(jh, commit_transaction) // Put jh into trans1->t_checkpoint_list journal->j_checkpoint_transactions = commit_transaction // Put trans1 into journal->j_checkpoint_transactions Step 2: do_get_write_access test_clear_buffer_dirty(bh) // clear buffer dirty，set jbd dirty __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2 Step 3: drop_cache journal_shrink_one_cp_list jbd2_journal_try_remove_checkpoint if (!trylock_buffer(bh)) // lock bh, true if (buffer_dirty(bh)) // buffer is not dirty __jbd2_journal_remove_checkpoint(jh) // remove jh from trans1->t_checkpoint_list Step 4: jbd2_log_do_checkpoint trans1 = journal->j_checkpoint_transactions // jh is not in trans1->t_checkpoint_list jbd2_cleanup_journal_tail(journal) // trans1 is done Step 5: Power cut, trans2 is not committed, jh is lost in next mounting. Fix it by checking 'jh->b_transaction' before remove it from checkpoint.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/ef5fea70e5915afd6…
https://git.kernel.org/stable/c/dbafe636db415299e…
https://git.kernel.org/stable/c/2298f2589903a8bc0…
https://git.kernel.org/stable/c/590a809ff743e7bd8…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: b832174b7f89df3ebab02f5b485d00127a0e1a6e , < ef5fea70e5915afd64182d155e72bfb4f275e1fc (git) Affected: e5c768d809a85e9efd0274b2efe69d4970cc0014 , < dbafe636db415299e54d9dfefc1003bda9e71c9d (git) Affected: 46f881b5b1758dc4a35fba4a643c10717d0cf427 , < 2298f2589903a8bc03061b54b31fd97985ab6529 (git) Affected: 46f881b5b1758dc4a35fba4a643c10717d0cf427 , < 590a809ff743e7bd890ba5fb36bc38e20a36de53 (git) Affected: 019b59aeb2af6b47d5c8e69c5dc1d731c8df0354 (git) Affected: 5.15.129 , < 5.15.132 (semver) Affected: 6.1.50 , < 6.1.54 (semver) Affected: 6.4.13 , < 6.5 (semver)	guessed
Linux	Linux	Affected: 6.5 Unaffected: 0 , < 6.5 (semver) Unaffected: 5.15.132 , ≤ 5.15.* (semver) Unaffected: 6.1.54 , ≤ 6.1.* (semver) Unaffected: 6.5.4 , ≤ 6.5.* (semver) Unaffected: 6.6 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/jbd2/checkpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef5fea70e5915afd64182d155e72bfb4f275e1fc",
              "status": "affected",
              "version": "b832174b7f89df3ebab02f5b485d00127a0e1a6e",
              "versionType": "git"
            },
            {
              "lessThan": "dbafe636db415299e54d9dfefc1003bda9e71c9d",
              "status": "affected",
              "version": "e5c768d809a85e9efd0274b2efe69d4970cc0014",
              "versionType": "git"
            },
            {
              "lessThan": "2298f2589903a8bc03061b54b31fd97985ab6529",
              "status": "affected",
              "version": "46f881b5b1758dc4a35fba4a643c10717d0cf427",
              "versionType": "git"
            },
            {
              "lessThan": "590a809ff743e7bd890ba5fb36bc38e20a36de53",
              "status": "affected",
              "version": "46f881b5b1758dc4a35fba4a643c10717d0cf427",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "019b59aeb2af6b47d5c8e69c5dc1d731c8df0354",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.132",
              "status": "affected",
              "version": "5.15.129",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.54",
              "status": "affected",
              "version": "6.1.50",
              "versionType": "semver"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/jbd2/checkpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.132",
                  "versionStartIncluding": "5.15.129",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.54",
                  "versionStartIncluding": "6.1.50",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.4",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: check \u0027jh-\u003eb_transaction\u0027 before removing it from checkpoint\n\nFollowing process will corrupt ext4 image:\nStep 1:\njbd2_journal_commit_transaction\n __jbd2_journal_insert_checkpoint(jh, commit_transaction)\n // Put jh into trans1-\u003et_checkpoint_list\n journal-\u003ej_checkpoint_transactions = commit_transaction\n // Put trans1 into journal-\u003ej_checkpoint_transactions\n\nStep 2:\ndo_get_write_access\n test_clear_buffer_dirty(bh) // clear buffer dirty\uff0cset jbd dirty\n __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2\n\nStep 3:\ndrop_cache\n journal_shrink_one_cp_list\n  jbd2_journal_try_remove_checkpoint\n   if (!trylock_buffer(bh))  // lock bh, true\n   if (buffer_dirty(bh))     // buffer is not dirty\n   __jbd2_journal_remove_checkpoint(jh)\n   // remove jh from trans1-\u003et_checkpoint_list\n\nStep 4:\njbd2_log_do_checkpoint\n trans1 = journal-\u003ej_checkpoint_transactions\n // jh is not in trans1-\u003et_checkpoint_list\n jbd2_cleanup_journal_tail(journal)  // trans1 is done\n\nStep 5: Power cut, trans2 is not committed, jh is lost in next mounting.\n\nFix it by checking \u0027jh-\u003eb_transaction\u0027 before remove it from checkpoint."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable checkpoint scan is reached through ordinary VFS write/fsync syscalls and memory reclaim on a locally mounted ext4/ocfs2 filesystem. There is no network protocol handler involved, so the attacker needs local access (or an account on a shared host).\nAC:L - The attacker drives both sides of the race entirely from userspace \u2014 repeatedly re-dirtying already-checkpointed metadata blocks (rename/unlink/create storms against the same inode-table and bitmap blocks) while allocating memory to fire the jbd2 shrinker, on top of the commit-time `__jbd2_journal_clean_checkpoint_list()` path that runs every 5 seconds regardless. The window can be retried indefinitely at no cost, and the unclean shutdown that exposes the loss is routine in the deployment classes most affected (embedded, automotive, IoT, battery devices, cloud instances subject to host failure).\nPR:L - Any unprivileged local user with write access to any ext4/ocfs2 filesystem \u2014 /tmp or their own home directory suffices \u2014 generates the journal commits and reclaim pressure that hit the racy path. No capabilities, mount privileges, or user-namespace tricks are needed.\nUI:N - The attacker\u0027s own filesystem workload plus background commit/reclaim activity is sufficient; no action by any other user is required. The subsequent power loss or crash is an environmental event, not user interaction.\nS:U - The corruption stays within the kernel\u0027s own filesystem stack and the affected block device; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Rolling a metadata block back to a pre-trans1 state resurrects stale inode block pointers and allocation bitmaps, cross-linking blocks that were freed and have since been reallocated to other users\u0027 files, so an unprivileged user can end up reading arbitrary other-tenant file contents. The exposure is unbounded in size rather than a small fixed leak.\nI:H - The bug causes silent, permanent loss of committed filesystem metadata \u2014 inode tables, block/inode bitmaps, extent trees and directory blocks (and file data under data=journal) \u2014 that survives journal replay, which is exactly the \"corrupt ext4 image\" outcome described by the fix author. This is arbitrary, attacker-influenced modification of on-disk state with no integrity protection remaining.\nA:H - The resulting inconsistency triggers `ext4_error()` on the next access, which takes the filesystem read-only under the default errors=remount-ro or panics the machine under errors=panic; a corrupted root filesystem leaves an embedded, automotive, or appliance device unbootable until an offline fsck."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:37.200Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef5fea70e5915afd64182d155e72bfb4f275e1fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbafe636db415299e54d9dfefc1003bda9e71c9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2298f2589903a8bc03061b54b31fd97985ab6529"
        },
        {
          "url": "https://git.kernel.org/stable/c/590a809ff743e7bd890ba5fb36bc38e20a36de53"
        }
      ],
      "title": "jbd2: check \u0027jh-\u003eb_transaction\u0027 before removing it from checkpoint",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53526",
    "datePublished": "2025-10-01T11:46:11.862Z",
    "dateReserved": "2025-10-01T11:39:39.407Z",
    "dateUpdated": "2026-08-05T09:14:37.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53526",
      "date": "2026-09-19",
      "epss": "0.00154",
      "percentile": "0.04909"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/jbd2/checkpoint.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ef5fea70e5915afd64182d155e72bfb4f275e1fc",
                    "status": "affected",
                    "version": "b832174b7f89df3ebab02f5b485d00127a0e1a6e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dbafe636db415299e54d9dfefc1003bda9e71c9d",
                    "status": "affected",
                    "version": "e5c768d809a85e9efd0274b2efe69d4970cc0014",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2298f2589903a8bc03061b54b31fd97985ab6529",
                    "status": "affected",
                    "version": "46f881b5b1758dc4a35fba4a643c10717d0cf427",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "590a809ff743e7bd890ba5fb36bc38e20a36de53",
                    "status": "affected",
                    "version": "46f881b5b1758dc4a35fba4a643c10717d0cf427",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "019b59aeb2af6b47d5c8e69c5dc1d731c8df0354",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.15.132",
                    "status": "affected",
                    "version": "5.15.129",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.54",
                    "status": "affected",
                    "version": "6.1.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.5",
                    "status": "affected",
                    "version": "6.4.13",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/jbd2/checkpoint.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.5"
                  },
                  {
                    "lessThan": "6.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.132",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.5.*",
                    "status": "unaffected",
                    "version": "6.5.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.6",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C48E6B18-69FC-487C-99B6-6FE6364CE6FF",
                    "versionEndExcluding": "5.15.132",
                    "versionStartIncluding": "5.15.129",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B0B2EC17-AAD2-4B53-8D36-E8446726A2B0",
                    "versionEndExcluding": "6.1.54",
                    "versionStartIncluding": "6.1.50",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B17E134C-96DA-49BA-A4B8-933F5D9C25A2",
                    "versionEndExcluding": "6.5",
                    "versionStartIncluding": "6.4.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6F0E010F-32B3-4C0E-AB36-F808FAEBE852",
                    "versionEndExcluding": "6.5.4",
                    "versionStartIncluding": "6.5.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:-:*:*:*:*:*:*",
                    "matchCriteriaId": "A2D9420A-9BF4-4C16-B6DA-8A1D279F7384",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F5608371-157A-4318-8A2E-4104C3467EA1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "2226A776-DF8C-49E0-A030-0A7853BB018A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "6F15C659-DF06-455A-9765-0E6DE920F29A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "5B1C14ED-ABC4-41D3-8D9C-D38C6A65B4DE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "F187F8CD-249A-4AF1-877B-08E8C24A1A10",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: check \u0027jh-\u003eb_transaction\u0027 before removing it from checkpoint\n\nFollowing process will corrupt ext4 image:\nStep 1:\njbd2_journal_commit_transaction\n __jbd2_journal_insert_checkpoint(jh, commit_transaction)\n // Put jh into trans1-\u003et_checkpoint_list\n journal-\u003ej_checkpoint_transactions = commit_transaction\n // Put trans1 into journal-\u003ej_checkpoint_transactions\n\nStep 2:\ndo_get_write_access\n test_clear_buffer_dirty(bh) // clear buffer dirty\uff0cset jbd dirty\n __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2\n\nStep 3:\ndrop_cache\n journal_shrink_one_cp_list\n  jbd2_journal_try_remove_checkpoint\n   if (!trylock_buffer(bh))  // lock bh, true\n   if (buffer_dirty(bh))     // buffer is not dirty\n   __jbd2_journal_remove_checkpoint(jh)\n   // remove jh from trans1-\u003et_checkpoint_list\n\nStep 4:\njbd2_log_do_checkpoint\n trans1 = journal-\u003ej_checkpoint_transactions\n // jh is not in trans1-\u003et_checkpoint_list\n jbd2_cleanup_journal_tail(journal)  // trans1 is done\n\nStep 5: Power cut, trans2 is not committed, jh is lost in next mounting.\n\nFix it by checking \u0027jh-\u003eb_transaction\u0027 before remove it from checkpoint."
          }
        ],
        "id": "CVE-2023-53526",
        "lastModified": "2026-08-04T10:19:10.633",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-10-01T12:15:57.177",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2298f2589903a8bc03061b54b31fd97985ab6529"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/590a809ff743e7bd890ba5fb36bc38e20a36de53"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dbafe636db415299e54d9dfefc1003bda9e71c9d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ef5fea70e5915afd64182d155e72bfb4f275e1fc"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-08T22:49:42+00:00",
      "cve": "CVE-2023-53526",
      "id": "CVE-2023-53526",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "122",
      "product_status:known_not_affected": "152",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: jbd2: check \u0027jh-\u003eb_transaction\u0027 before removing it from checkpoint",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53526.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:43:34Z",
      "cve": "CVE-2023-53526",
      "id": "CVE-2023-53526",
      "initial_release_date": "2026-05-23T01:37:32Z",
      "product_status:known_affected": "344",
      "product_status:known_not_affected": "207",
      "product_status:recommended": "539",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53526",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53526.json",
      "version": "10"
    }
  }
}

FKIE_CVE-2023-53526

Vulnerability from fkie_nvd - Published: 2025-10-01 12:15 - Updated: 2026-08-04 10:19

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2298f2589903a8bc03061b54b31fd97985ab6529	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/590a809ff743e7bd890ba5fb36bc38e20a36de53	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/dbafe636db415299e54d9dfefc1003bda9e71c9d	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ef5fea70e5915afd64182d155e72bfb4f275e1fc	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.5
linux	linux_kernel	6.5
linux	linux_kernel	6.5
linux	linux_kernel	6.5
linux	linux_kernel	6.5
linux	linux_kernel	6.5

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/jbd2/checkpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef5fea70e5915afd64182d155e72bfb4f275e1fc",
              "status": "affected",
              "version": "b832174b7f89df3ebab02f5b485d00127a0e1a6e",
              "versionType": "git"
            },
            {
              "lessThan": "dbafe636db415299e54d9dfefc1003bda9e71c9d",
              "status": "affected",
              "version": "e5c768d809a85e9efd0274b2efe69d4970cc0014",
              "versionType": "git"
            },
            {
              "lessThan": "2298f2589903a8bc03061b54b31fd97985ab6529",
              "status": "affected",
              "version": "46f881b5b1758dc4a35fba4a643c10717d0cf427",
              "versionType": "git"
            },
            {
              "lessThan": "590a809ff743e7bd890ba5fb36bc38e20a36de53",
              "status": "affected",
              "version": "46f881b5b1758dc4a35fba4a643c10717d0cf427",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "019b59aeb2af6b47d5c8e69c5dc1d731c8df0354",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.132",
              "status": "affected",
              "version": "5.15.129",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.54",
              "status": "affected",
              "version": "6.1.50",
              "versionType": "semver"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/jbd2/checkpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C48E6B18-69FC-487C-99B6-6FE6364CE6FF",
              "versionEndExcluding": "5.15.132",
              "versionStartIncluding": "5.15.129",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0B2EC17-AAD2-4B53-8D36-E8446726A2B0",
              "versionEndExcluding": "6.1.54",
              "versionStartIncluding": "6.1.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B17E134C-96DA-49BA-A4B8-933F5D9C25A2",
              "versionEndExcluding": "6.5",
              "versionStartIncluding": "6.4.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F0E010F-32B3-4C0E-AB36-F808FAEBE852",
              "versionEndExcluding": "6.5.4",
              "versionStartIncluding": "6.5.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:-:*:*:*:*:*:*",
              "matchCriteriaId": "A2D9420A-9BF4-4C16-B6DA-8A1D279F7384",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "F5608371-157A-4318-8A2E-4104C3467EA1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "2226A776-DF8C-49E0-A030-0A7853BB018A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "6F15C659-DF06-455A-9765-0E6DE920F29A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "5B1C14ED-ABC4-41D3-8D9C-D38C6A65B4DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "F187F8CD-249A-4AF1-877B-08E8C24A1A10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: check \u0027jh-\u003eb_transaction\u0027 before removing it from checkpoint\n\nFollowing process will corrupt ext4 image:\nStep 1:\njbd2_journal_commit_transaction\n __jbd2_journal_insert_checkpoint(jh, commit_transaction)\n // Put jh into trans1-\u003et_checkpoint_list\n journal-\u003ej_checkpoint_transactions = commit_transaction\n // Put trans1 into journal-\u003ej_checkpoint_transactions\n\nStep 2:\ndo_get_write_access\n test_clear_buffer_dirty(bh) // clear buffer dirty\uff0cset jbd dirty\n __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2\n\nStep 3:\ndrop_cache\n journal_shrink_one_cp_list\n  jbd2_journal_try_remove_checkpoint\n   if (!trylock_buffer(bh))  // lock bh, true\n   if (buffer_dirty(bh))     // buffer is not dirty\n   __jbd2_journal_remove_checkpoint(jh)\n   // remove jh from trans1-\u003et_checkpoint_list\n\nStep 4:\njbd2_log_do_checkpoint\n trans1 = journal-\u003ej_checkpoint_transactions\n // jh is not in trans1-\u003et_checkpoint_list\n jbd2_cleanup_journal_tail(journal)  // trans1 is done\n\nStep 5: Power cut, trans2 is not committed, jh is lost in next mounting.\n\nFix it by checking \u0027jh-\u003eb_transaction\u0027 before remove it from checkpoint."
    }
  ],
  "id": "CVE-2023-53526",
  "lastModified": "2026-08-04T10:19:10.633",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-10-01T12:15:57.177",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2298f2589903a8bc03061b54b31fd97985ab6529"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/590a809ff743e7bd890ba5fb36bc38e20a36de53"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/dbafe636db415299e54d9dfefc1003bda9e71c9d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/ef5fea70e5915afd64182d155e72bfb4f275e1fc"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-RHFJ-R57G-8474

Vulnerability from github – Published: 2025-10-01 12:30 – Updated: 2026-01-27 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

jbd2: check 'jh->b_transaction' before removing it from checkpoint

Following process will corrupt ext4 image: Step 1: jbd2_journal_commit_transaction __jbd2_journal_insert_checkpoint(jh, commit_transaction) // Put jh into trans1->t_checkpoint_list journal->j_checkpoint_transactions = commit_transaction // Put trans1 into journal->j_checkpoint_transactions

Step 2: do_get_write_access test_clear_buffer_dirty(bh) // clear buffer dirty，set jbd dirty __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2

Step 3: drop_cache journal_shrink_one_cp_list jbd2_journal_try_remove_checkpoint if (!trylock_buffer(bh)) // lock bh, true if (buffer_dirty(bh)) // buffer is not dirty __jbd2_journal_remove_checkpoint(jh) // remove jh from trans1->t_checkpoint_list

Step 4: jbd2_log_do_checkpoint trans1 = journal->j_checkpoint_transactions // jh is not in trans1->t_checkpoint_list jbd2_cleanup_journal_tail(journal) // trans1 is done

Step 5: Power cut, trans2 is not committed, jh is lost in next mounting.

Fix it by checking 'jh->b_transaction' before remove it from checkpoint.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-53526"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-01T12:15:57Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: check \u0027jh-\u003eb_transaction\u0027 before removing it from checkpoint\n\nFollowing process will corrupt ext4 image:\nStep 1:\njbd2_journal_commit_transaction\n __jbd2_journal_insert_checkpoint(jh, commit_transaction)\n // Put jh into trans1-\u003et_checkpoint_list\n journal-\u003ej_checkpoint_transactions = commit_transaction\n // Put trans1 into journal-\u003ej_checkpoint_transactions\n\nStep 2:\ndo_get_write_access\n test_clear_buffer_dirty(bh) // clear buffer dirty\uff0cset jbd dirty\n __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2\n\nStep 3:\ndrop_cache\n journal_shrink_one_cp_list\n  jbd2_journal_try_remove_checkpoint\n   if (!trylock_buffer(bh))  // lock bh, true\n   if (buffer_dirty(bh))     // buffer is not dirty\n   __jbd2_journal_remove_checkpoint(jh)\n   // remove jh from trans1-\u003et_checkpoint_list\n\nStep 4:\njbd2_log_do_checkpoint\n trans1 = journal-\u003ej_checkpoint_transactions\n // jh is not in trans1-\u003et_checkpoint_list\n jbd2_cleanup_journal_tail(journal)  // trans1 is done\n\nStep 5: Power cut, trans2 is not committed, jh is lost in next mounting.\n\nFix it by checking \u0027jh-\u003eb_transaction\u0027 before remove it from checkpoint.",
  "id": "GHSA-rhfj-r57g-8474",
  "modified": "2026-01-27T21:31:34Z",
  "published": "2025-10-01T12:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53526"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2298f2589903a8bc03061b54b31fd97985ab6529"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/590a809ff743e7bd890ba5fb36bc38e20a36de53"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dbafe636db415299e54d9dfefc1003bda9e71c9d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ef5fea70e5915afd64182d155e72bfb4f275e1fc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

SUSE-SU-2025:03600-1

Vulnerability from csaf_suse - Published: 2025-10-15 12:54 - Updated: 2025-10-15 12:54

Summary

Security update for the Linux Kernel

Severity

Important

Scope

346 vulnerabilities in this advisory, including CVE-2023-53526.

CVE-2023-53526

0 (None)


                
                  CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

Recommended: 174 products

Open the full advisory

SUSE-SU-2025:03614-1

Vulnerability from csaf_suse - Published: 2025-10-16 05:48 - Updated: 2025-10-16 05:48

Summary

Security update for the Linux Kernel

Severity

Important

Scope

183 vulnerabilities in this advisory, including CVE-2023-53526.

CVE-2023-53526

0 (None)


                
                  CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

Recommended: 56 products

Open the full advisory

SUSE-SU-2025:03615-1

Vulnerability from csaf_suse - Published: 2025-10-16 05:49 - Updated: 2025-10-16 05:49

Summary

Security update for the Linux Kernel

Severity

Important

Scope

378 vulnerabilities in this advisory, including CVE-2023-53526.

CVE-2023-53526

0 (None)


                
                  CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

Recommended: 134 products

Open the full advisory

SUSE-SU-2025:03628-1

Vulnerability from csaf_suse - Published: 2025-10-17 11:34 - Updated: 2025-10-17 11:34

Summary

Security update for the Linux Kernel

Severity

Important

Scope

326 vulnerabilities in this advisory, including CVE-2023-53526.

CVE-2023-53526

0 (None)


                
                  CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

Recommended: 139 products

Open the full advisory

SUSE-SU-2025:03634-1

Vulnerability from csaf_suse - Published: 2025-10-17 14:32 - Updated: 2025-10-17 14:32

Summary

Security update for the Linux Kernel

Severity

Important

Scope

445 vulnerabilities in this advisory, including CVE-2023-53526.

CVE-2023-53526

0 (None)


                
                  CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

Recommended: 33 products

Open the full advisory

SUSE-SU-2025:20851-1

Vulnerability from csaf_suse - Published: 2025-10-15 16:17 - Updated: 2025-10-15 16:17

Summary

Security update for the Linux Kernel

Severity

Important

Scope

346 vulnerabilities in this advisory, including CVE-2023-53526.

CVE-2023-53526

0 (None)


                
                  CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

Recommended: 11 products

Open the full advisory

SUSE-SU-2025:20861-1

Vulnerability from csaf_suse - Published: 2025-10-15 15:17 - Updated: 2025-10-15 15:17

Summary

Security update for the Linux Kernel

Severity

Important

Scope

346 vulnerabilities in this advisory, including CVE-2023-53526.

CVE-2023-53526

0 (None)


                
                  CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

Recommended: 17 products

Open the full advisory

SUSE-SU-2025:20870-1

Vulnerability from csaf_suse - Published: 2025-10-23 16:01 - Updated: 2025-10-23 16:01

Summary

Security update for the Linux Kernel

Severity

Important

Scope

346 vulnerabilities in this advisory, including CVE-2023-53526.

CVE-2023-53526

0 (None)


                
                  CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-53526 (GCVE-0-2023-53526)

Tags

Sightings

Nomenclature

Related by attack behaviour