CVE-2023-54140

Root

Cause

In the Linux kernel's nilfs2 filesystem, a vulnerability exists in how metadata buffer pointers are cached and reused in local structures. When the filesystem encounters a corrupted disk image, certain critical operations (such as nilfs_clear_dirty_page()) can forcibly discard these cached buffers. If a subsequent call to mark_buffer_dirty() (via __nilfs_mark_inode_dirty() or nilfs_palloc_commit_alloc_entry()) attempts to) attempts to reuse a discarded buffer, the kernel triggers a WARNING and may panic if panic_on_warn` is set [1][2].

Attack

Surface

An attacker with the ability to mount a specially crafted corrupted nilfs2 image can trigger this condition without requiring any special privileges beyond the ability to mount a filesystem. The issue is exacerbated after commit 28a65b49eb53 ("nilfs2: do not write dirty data after degenerating to read-only"), but the underlying problem has existed for longer [1]. The attack surface is local; the attacker must be able to present a malicious disk image to the kernel.

Impact

Successful exploitation leads to a kernel WARNING and, if the system is configured with panic_on_warn, a full system panic (denial of service). No privilege escalation or data corruption beyond the filesystem itself is described.

Mitigation

The fix, applied in multiple stable kernel branches, adds a check for the uptodate flag on the cached buffer before reuse. If the flag is lost (indicating the buffer was discarded), the metadata is reloaded from disk instead of reusing the stale pointer [1][2][3][4]. Users should apply the relevant stable kernel update.