GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53846 (GCVE-0-2023-53846)

Vulnerability from cvelistv5 – Published: 2025-12-09 01:30 – Updated: 2026-08-05 09:16
VLAI
Title
f2fs: fix to do sanity check on direct node in truncate_dnode()
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on direct node in truncate_dnode() syzbot reports below bug: BUG: KASAN: slab-use-after-free in f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574 Read of size 4 at addr ffff88802a25c000 by task syz-executor148/5000 CPU: 1 PID: 5000 Comm: syz-executor148 Not tainted 6.4.0-rc7-syzkaller-00041-ge660abd551f1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351 print_report mm/kasan/report.c:462 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:572 f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574 truncate_dnode+0x229/0x2e0 fs/f2fs/node.c:944 f2fs_truncate_inode_blocks+0x64b/0xde0 fs/f2fs/node.c:1154 f2fs_do_truncate_blocks+0x4ac/0xf30 fs/f2fs/file.c:721 f2fs_truncate_blocks+0x7b/0x300 fs/f2fs/file.c:749 f2fs_truncate.part.0+0x4a5/0x630 fs/f2fs/file.c:799 f2fs_truncate include/linux/fs.h:825 [inline] f2fs_setattr+0x1738/0x2090 fs/f2fs/file.c:1006 notify_change+0xb2c/0x1180 fs/attr.c:483 do_truncate+0x143/0x200 fs/open.c:66 handle_truncate fs/namei.c:3295 [inline] do_open fs/namei.c:3640 [inline] path_openat+0x2083/0x2750 fs/namei.c:3791 do_filp_open+0x1ba/0x410 fs/namei.c:3818 do_sys_openat2+0x16d/0x4c0 fs/open.c:1356 do_sys_open fs/open.c:1372 [inline] __do_sys_creat fs/open.c:1448 [inline] __se_sys_creat fs/open.c:1442 [inline] __x64_sys_creat+0xcd/0x120 fs/open.c:1442 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The root cause is, inodeA references inodeB via inodeB's ino, once inodeA is truncated, it calls truncate_dnode() to truncate data blocks in inodeB's node page, it traverse mapping data from node->i.i_addr[0] to node->i.i_addr[ADDRS_PER_BLOCK() - 1], result in out-of-boundary access. This patch fixes to add sanity check on dnode page in truncate_dnode(), so that, it can help to avoid triggering such issue, and once it encounters such issue, it will record newly introduced ERROR_INVALID_NODE_REFERENCE error into superblock, later fsck can detect such issue and try repairing. Also, it removes f2fs_truncate_data_blocks() for cleanup due to the function has only one caller, and uses f2fs_truncate_data_blocks_range() instead.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 , < af0f716ad3b039cab9d426da63a5ee6c88751185 (git)
Affected: 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 , < a6ec83786ab9f13f25fb18166dee908845713a95 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.8
Unaffected: 0 , < 3.8 (semver)
Unaffected: 6.4.10 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h",
            "fs/f2fs/file.c",
            "fs/f2fs/node.c",
            "include/linux/f2fs_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af0f716ad3b039cab9d426da63a5ee6c88751185",
              "status": "affected",
              "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
              "versionType": "git"
            },
            {
              "lessThan": "a6ec83786ab9f13f25fb18166dee908845713a95",
              "status": "affected",
              "version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h",
            "fs/f2fs/file.c",
            "fs/f2fs/node.c",
            "include/linux/f2fs_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.10",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on direct node in truncate_dnode()\n\nsyzbot reports below bug:\n\nBUG: KASAN: slab-use-after-free in f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574\nRead of size 4 at addr ffff88802a25c000 by task syz-executor148/5000\n\nCPU: 1 PID: 5000 Comm: syz-executor148 Not tainted 6.4.0-rc7-syzkaller-00041-ge660abd551f1 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106\n print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351\n print_report mm/kasan/report.c:462 [inline]\n kasan_report+0x11c/0x130 mm/kasan/report.c:572\n f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574\n truncate_dnode+0x229/0x2e0 fs/f2fs/node.c:944\n f2fs_truncate_inode_blocks+0x64b/0xde0 fs/f2fs/node.c:1154\n f2fs_do_truncate_blocks+0x4ac/0xf30 fs/f2fs/file.c:721\n f2fs_truncate_blocks+0x7b/0x300 fs/f2fs/file.c:749\n f2fs_truncate.part.0+0x4a5/0x630 fs/f2fs/file.c:799\n f2fs_truncate include/linux/fs.h:825 [inline]\n f2fs_setattr+0x1738/0x2090 fs/f2fs/file.c:1006\n notify_change+0xb2c/0x1180 fs/attr.c:483\n do_truncate+0x143/0x200 fs/open.c:66\n handle_truncate fs/namei.c:3295 [inline]\n do_open fs/namei.c:3640 [inline]\n path_openat+0x2083/0x2750 fs/namei.c:3791\n do_filp_open+0x1ba/0x410 fs/namei.c:3818\n do_sys_openat2+0x16d/0x4c0 fs/open.c:1356\n do_sys_open fs/open.c:1372 [inline]\n __do_sys_creat fs/open.c:1448 [inline]\n __se_sys_creat fs/open.c:1442 [inline]\n __x64_sys_creat+0xcd/0x120 fs/open.c:1442\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe root cause is, inodeA references inodeB via inodeB\u0027s ino, once inodeA\nis truncated, it calls truncate_dnode() to truncate data blocks in inodeB\u0027s\nnode page, it traverse mapping data from node-\u003ei.i_addr[0] to\nnode-\u003ei.i_addr[ADDRS_PER_BLOCK() - 1], result in out-of-boundary access.\n\nThis patch fixes to add sanity check on dnode page in truncate_dnode(),\nso that, it can help to avoid triggering such issue, and once it encounters\nsuch issue, it will record newly introduced ERROR_INVALID_NODE_REFERENCE\nerror into superblock, later fsck can detect such issue and try repairing.\n\nAlso, it removes f2fs_truncate_data_blocks() for cleanup due to the\nfunction has only one caller, and uses f2fs_truncate_data_blocks_range()\ninstead."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local syscalls (`creat`/`truncate`/`ftruncate`) on a file in a mounted f2fs image; there is no network-facing path into `truncate_dnode()`. Attack requires local system access to mount the crafted image and operate on it.\nAC:L - The corrupted node reference is fully attacker-controlled on-disk data, and syzbot has a deterministic reproducer \u2014 a single truncate on the crafted inode reliably drives the loop past the end of the inode page. No race or uncontrollable state is involved.\nPR:L - An unprivileged local user can get an arbitrary f2fs image mounted on common deployments (udisks2/systemd-mount removable-media policy for active sessions, Android vold adoptable storage), and triggering the truncate afterward needs only ordinary write access to a file. No root in the initial namespace is required in these configurations.\nUI:N - The same unprivileged attacker performs both the mount (via the removable-media auto-mount path) and the truncate syscall; no separate victim action is needed once the image is attached.\nS:U - The out-of-bounds access and any resulting corruption stay within the kernel\u0027s own security authority \u2014 this is a standard in-kernel memory-safety flaw with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The loop performs an out-of-bounds read of ~84 four-byte words past the end of the node page (KASAN reports it as slab-use-after-free), and those adjacent-page values are consumed as block addresses that get invalidated and reflected in the extent cache and block accounting, disclosing adjacent kernel heap contents.\nI:H - Every non-zero out-of-bounds word triggers `f2fs_set_data_blkaddr()` \u2192 `__set_data_blkaddr()`, writing a 4-byte zero through the same OOB pointer \u2014 an out-of-bounds write into the neighbouring physical page, plus corruption of SIT/valid-block accounting and freeing of blocks belonging to other inodes.\nA:H - The out-of-bounds access reliably produces a KASAN slab-use-after-free splat and can panic the kernel, and the bogus block addresses and inflated free counts drive `f2fs_invalidate_blocks()`/`dec_valid_block_count()` into `f2fs_bug_on()` conditions."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:23.337Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af0f716ad3b039cab9d426da63a5ee6c88751185"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6ec83786ab9f13f25fb18166dee908845713a95"
        }
      ],
      "title": "f2fs: fix to do sanity check on direct node in truncate_dnode()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53846",
    "datePublished": "2025-12-09T01:30:09.202Z",
    "dateReserved": "2025-12-09T01:27:17.827Z",
    "dateUpdated": "2026-08-05T09:16:23.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53846",
      "date": "2026-09-16",
      "epss": "0.0017",
      "percentile": "0.06749"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53846\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-09T16:17:25.003\",\"lastModified\":\"2026-08-04T10:19:23.927\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: fix to do sanity check on direct node in truncate_dnode()\\n\\nsyzbot reports below bug:\\n\\nBUG: KASAN: slab-use-after-free in f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574\\nRead of size 4 at addr ffff88802a25c000 by task syz-executor148/5000\\n\\nCPU: 1 PID: 5000 Comm: syz-executor148 Not tainted 6.4.0-rc7-syzkaller-00041-ge660abd551f1 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106\\n print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351\\n print_report mm/kasan/report.c:462 [inline]\\n kasan_report+0x11c/0x130 mm/kasan/report.c:572\\n f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574\\n truncate_dnode+0x229/0x2e0 fs/f2fs/node.c:944\\n f2fs_truncate_inode_blocks+0x64b/0xde0 fs/f2fs/node.c:1154\\n f2fs_do_truncate_blocks+0x4ac/0xf30 fs/f2fs/file.c:721\\n f2fs_truncate_blocks+0x7b/0x300 fs/f2fs/file.c:749\\n f2fs_truncate.part.0+0x4a5/0x630 fs/f2fs/file.c:799\\n f2fs_truncate include/linux/fs.h:825 [inline]\\n f2fs_setattr+0x1738/0x2090 fs/f2fs/file.c:1006\\n notify_change+0xb2c/0x1180 fs/attr.c:483\\n do_truncate+0x143/0x200 fs/open.c:66\\n handle_truncate fs/namei.c:3295 [inline]\\n do_open fs/namei.c:3640 [inline]\\n path_openat+0x2083/0x2750 fs/namei.c:3791\\n do_filp_open+0x1ba/0x410 fs/namei.c:3818\\n do_sys_openat2+0x16d/0x4c0 fs/open.c:1356\\n do_sys_open fs/open.c:1372 [inline]\\n __do_sys_creat fs/open.c:1448 [inline]\\n __se_sys_creat fs/open.c:1442 [inline]\\n __x64_sys_creat+0xcd/0x120 fs/open.c:1442\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\nThe root cause is, inodeA references inodeB via inodeB\u0027s ino, once inodeA\\nis truncated, it calls truncate_dnode() to truncate data blocks in inodeB\u0027s\\nnode page, it traverse mapping data from node-\u003ei.i_addr[0] to\\nnode-\u003ei.i_addr[ADDRS_PER_BLOCK() - 1], result in out-of-boundary access.\\n\\nThis patch fixes to add sanity check on dnode page in truncate_dnode(),\\nso that, it can help to avoid triggering such issue, and once it encounters\\nsuch issue, it will record newly introduced ERROR_INVALID_NODE_REFERENCE\\nerror into superblock, later fsck can detect such issue and try repairing.\\n\\nAlso, it removes f2fs_truncate_data_blocks() for cleanup due to the\\nfunction has only one caller, and uses f2fs_truncate_data_blocks_range()\\ninstead.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/f2fs/f2fs.h\",\"fs/f2fs/file.c\",\"fs/f2fs/node.c\",\"include/linux/f2fs_fs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\",\"lessThan\":\"af0f716ad3b039cab9d426da63a5ee6c88751185\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98e4da8ca301e062d79ae168c67e56f3c3de3ce4\",\"lessThan\":\"a6ec83786ab9f13f25fb18166dee908845713a95\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/f2fs/f2fs.h\",\"fs/f2fs/file.c\",\"fs/f2fs/node.c\",\"include/linux/f2fs_fs.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.10\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a6ec83786ab9f13f25fb18166dee908845713a95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af0f716ad3b039cab9d426da63a5ee6c88751185\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:15:43+00:00",
      "cve": "CVE-2023-53846",
      "id": "CVE-2023-53846",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: fix to do sanity check on direct node in truncate_dnode()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53846.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T17:05:29Z",
      "cve": "CVE-2023-53846",
      "id": "CVE-2023-53846",
      "initial_release_date": "2025-12-10T00:34:46Z",
      "product_status:known_affected": "589",
      "product_status:known_not_affected": "237",
      "product_status:recommended": "212",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53846",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53846.json",
      "version": "31"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.