CVE-2023-52582

What it actually does

Double invocation of folio_start_fscache() on the same folio inside netfs_rreq_unlock_folios() when a network filesystem's clamp_length() produces sub-page-length subrequests, triggering VM_BUG_ON_FOLIO(folio_test_private_2(folio)) and a kernel oops.

Why it matters to the business

Systems running affected Linux kernels with network filesystems (NFS, etc.) using fscache and small rsize/wsize can experience sudden kernel crashes during ordinary file reads, causing denial of service and potential data loss for workloads that rely on those mounts.

How an attack unfolds

An attacker with local access mounts a netfs export with fsc,rsize=1024,wsize=1024, writes a page-sized file, drops caches, then reads it back; the resulting subrequest processing path calls folio_start_fscache() twice for the same folio and crashes the kernel.

How to fix it

Update the Linux kernel to commit df9950d37df113db59495fa09d060754366a2b7c or later; rebuild and reboot all affected hosts. Until patched kernels are deployed, avoid enabling fscache on mounts that use sub-page I/O sizes.

How to confirm the fix worked

Confirm the running kernel contains commit df9950d37df113db59495fa09d060754366a2b7c; re-execute the provided reproducer (mount with fsc/rsize=1024, write+drop_caches+read) and verify no VM_BUG_ON occurs.

Typical attack path

1. Mount netfs filesystem with fscache enabled and rsize/wsize smaller than page size
2. Perform write of page-aligned data
3. Drop page cache
4. Read the same data back, causing netfs read completion path to execute
5. netfs_rreq_unlock_folios() iterates folios and invokes folio_start_fscache() multiple times
6. Kernel hits assertion and oopses

How to detect it

Search kernel logs for the strings 'VM_BUG_ON_FOLIO(folio_test_private_2(folio))', 'netfs_rreq_unlock_folios', 'folio_start_fscache', and 'kernel BUG at include/linux/netfs.h:44'; correlate with processes performing reads on fscache-enabled netfs mounts.

• VM_BUG_ON_FOLIO(folio_test_private_2(folio))
• kernel BUG at include/linux/netfs.h:44
• netfs_rreq_unlock_folios+0x68e
• netfs_rreq_assess
• nfs_netfs_read_completion

What your security team should do

• Prioritize patching kernel packages on all systems that mount NFS or other netfs exports with fscache
• Add the fixed commit hash to internal kernel build pipelines and CI
• Temporarily disable fscache on affected mounts if immediate reboot is not feasible
• Monitor EPSS and KEV status for any future increase in exploit activity