Cloudanix VulnDB

CVE-2023-54124

None

CVSS

—

EPSS

0.2%

Published

Dec 24, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux can make the system crash when unmounting certain storage under specific error conditions.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw prevents proper handling of dirty pages during umount when cp_error is set in f2fs, leading to a non-zero fsync_node_num and triggering a kernel BUG assertion in f2fs_put_super.

Why it matters to the business

Can cause kernel panics on Linux systems using the f2fs filesystem during unmount operations if checkpoint errors occur, leading to system instability and potential service disruption. Low ecosystem prevalence as a niche filesystem issue.

How an attack unfolds

An attacker with local access could trigger checkpoint errors in f2fs and then attempt to unmount the filesystem to cause a crash. No known threat actors or active exploitation campaigns.

How to fix it

Upgrade the Linux kernel to a version containing commit 92575f05a32dafb16348bfa5e62478118a9be069 or apply the equivalent patch from the stable tree.

How to confirm the fix worked

Confirm the running kernel includes commit 92575f05a32dafb16348bfa5e62478118a9be069; reproduce cp_error scenarios followed by umount to verify absence of the BUG.

Typical attack path

  1. Obtain local access on a Linux system using f2fs
  2. Induce a cp_error condition in the f2fs filesystem
  3. Trigger an umount operation to hit the assertion failure

How to detect it

Inspect kernel logs and crash dumps for f2fs_put_super BUG traces referencing fsync_node_num; correlate with umount activity on f2fs mounts.

  • f2fs_bug_on(sbi, sbi->fsync_node_num)
  • RIP: f2fs_put_super+0x3a8/0x3b0
  • Call Trace: generic_shutdown_super

What your security team should do

  • Apply the kernel fix containing commit 92575f05a32dafb16348bfa5e62478118a9be069 as soon as possible
  • Audit systems for f2fs usage and prioritize patching where present
  • Monitor kernel logs for f2fs BUG reports during unmount

The record

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to drop all dirty pages during umount() if cp_error is set xfstest generic/361 reports a bug as below: f2fs_bug_on(sbi, sbi->fsync_node_num); kernel BUG at fs/f2fs/super.c:1627! RIP: 0010:f2fs_put_super+0x3a8/0x3b0 Call Trace: generic_shutdown_super+0x8c/0x1b0 kill_block_super+0x2b/0x60 kill_f2fs_super+0x87/0x110 deactivate_locked_super+0x39/0x80 deactivate_super+0x46/0x50 cleanup_mnt+0x109/0x170 __cleanup_mnt+0x16/0x20 task_work_run+0x65/0xa0 exit_to_user_mode_prepare+0x175/0x190 syscall_exit_to_user_mode+0x25/0x50 do_syscall_64+0x4c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc During umount(), if cp_error is set, f2fs_wait_on_all_pages() should not stop waiting all F2FS_WB_CP_DATA pages to be writebacked, otherwise, fsync_node_num can be non-zero after f2fs_wait_on_all_pages() causing this bug. In this case, to avoid deadloop in f2fs_wait_on_all_pages(), it needs to drop all dirty pages rather than redirtying them.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 4.19.284
Linux Kernel 4.19.0 4.19.284

Related vulnerabilities