CVE-2023-52805

What it actually does

Missing bounds check on allocation group number (agno) during JFS inode allocation in diAlloc allows array index out-of-bounds access in the Linux kernel.

Why it matters to the business

Systems using the JFS filesystem risk kernel crashes, memory corruption, or denial of service; high prevalence of Linux kernels increases exposure across servers and devices.

How an attack unfolds

An attacker with local access crafts filesystem operations or mounts a malicious JFS image to trigger inode allocation paths that supply an out-of-range agno value, resulting in out-of-bounds memory access.

How to fix it

Upgrade the Linux kernel to a version containing commit 2308d0fb0dc32446b4e6ca37cd09c30374bb64e9 or later; disable JFS if unused.

How to confirm the fix worked

Verify kernel source or binary contains the referenced commit; test inode allocation paths with boundary agno values; monitor for absence of prior OOB crashes in logs.

Typical attack path

1. Obtain local access or ability to supply filesystem images
2. Mount or operate on a JFS filesystem triggering diAlloc
3. Supply invalid agno value bypassing prior checks
4. Trigger array index out-of-bounds memory access
5. Cause kernel panic or potential corruption

How to detect it

Review kernel logs for JFS-related oops or panic messages involving diAlloc or array bounds violations; inspect mounted JFS filesystems for unusual inode allocation patterns.

What your security team should do

• Apply the fixed kernel commit immediately on all JFS-using systems
• Audit for JFS usage and migrate to supported filesystems where possible
• Enable kernel hardening features such as KASAN during testing
• Monitor EPSS and KEV updates for any change in exploitability