CVE-2023-52600

What it actually does

Use-after-free in JFS inode eviction when diMount(ipimap) fails, allowing access to a freed ipimap object in diFreeSpecial() due to asynchronous RCU-based release via jfs_free_node().

Why it matters to the business

May cause kernel crashes, memory corruption, or local privilege escalation on Linux systems using the JFS filesystem, leading to downtime, data loss, or unauthorized access with moderate urgency given the low EPSS and lack of known exploitation.

How an attack unfolds

An attacker with local access triggers a diMount failure during JFS operations to cause the ipimap object to be released asynchronously while still referenced, resulting in use-after-free during diFreeSpecial().

How to fix it

Upgrade the Linux kernel to include commit 81b4249ef37297fb17ba102a524039a05c6c5d35 or equivalent fixed versions that prevent initialization of sbi->ipimap on diMount failure.

How to confirm the fix worked

Confirm the applied kernel source contains the fix in jfs_evict_inode that skips sbi->ipimap assignment on diMount error; test JFS mount failure paths for absence of UAF.

Typical attack path

1. Obtain local access on a system using JFS
2. Trigger conditions that cause diMount(ipimap) to fail
3. Initiate inode eviction to invoke jfs_evict_inode
4. Exploit the dangling reference in diFreeSpecial() after RCU release

How to detect it

Review kernel logs and dmesg for JFS inode eviction panics, RCU-related warnings, or use-after-free stack traces involving jfs_evict_inode and diFreeSpecial; correlate with mount failure events.

What your security team should do

• Apply the referenced kernel commit or newer stable releases containing the fix
• Audit systems for JFS filesystem usage and consider migration if feasible
• Monitor kernel logs for JFS-related oops or memory errors
• Prioritize patching on multi-user or exposed Linux hosts