CVE-2023-53804

Vulnerability Details In the Linux kernel's nilfs2 filesystem, a use-after-free bug exists in nilfs_evict_inode(). During unmount, nilfs_detach_log_writer() frees the nilfs_root structure, but if inodes remain on the "garbage_list", nilfs_evict_inode() may still access the freed nilfs_root for cleanup, leading to a use-after-free read.

Exploitation An attacker with local access and the ability to mount a nilfs2 filesystem could trigger this condition by leaving inodes in the garbage list during unmount. No special privileges beyond normal user access are required if the attacker can mount and unmount filesystems. The race condition occurs during the unmount process.

Impact Successful exploitation could cause a kernel crash (denial of service) or potentially allow arbitrary code execution in kernel context, depending on memory state. The use-after-free can corrupt kernel memory.

Mitigation The fix, included in kernel stable updates [1][2][3][4], modifies nilfs_evict_inode() to skip metadata operations that use nilfs_root when the filesystem is read-only or the writer is detached. Users should apply latest kernel updates to mitigate this vulnerability.