CVE-2023-54127 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
Syzkaller reported the following issue: ================================================================== BUG: KASAN: double-free in slab_free mm/slub.c:3787 [inline]
BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3800 Free of addr ffff888086408000 by task syz-executor.4/12750 [...]
Call Trace: <TASK> [...]
kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:482 ____kasan_slab_free+0xfb/0x120 kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline]
__kmem_cache_free+0x71/0x110 mm/slub.c:3800 dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264 jfs_umount+0x248/0x3b0 fs/jfs/jfs_umount.c:87 jfs_put_super+0x86/0x190 fs/jfs/super.c:194 generic_shutdown_super+0x130/0x310 fs/super.c:492 kill_block_super+0x79/0xd0 fs/super.c:1386 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 cleanup_mnt+0x494/0x520 fs/namespace.c:1291 task_work_run+0x243/0x300 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0x124/0x150 kernel/entry/common.c:171 exit_to_user_mode_prepare+0xb2/0x140 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:296 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...]
</TASK>
Allocated by task 13352: kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x3d/0x60 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline]
__kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:580 [inline]
dbMount+0x54/0x980 fs/jfs/jfs_dmap.c:164 jfs_mount+0x1dd/0x830 fs/jfs/jfs_mount.c:121 jfs_fill_super+0x590/0xc50 fs/jfs/super.c:556 mount_bdev+0x26c/0x3a0 fs/super.c:1359 legacy_get_tree+0xea/0x180 fs/fs_context.c:610 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline]
__do_sys_mount fs/namespace.c:3697 [inline]
__se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 13352: kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x3d/0x60 mm/kasan/common.c:52 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236 kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline]
__kmem_cache_free+0x71/0x110 mm/slub.c:3800 dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264 jfs_mount_rw+0x545/0x740 fs/jfs/jfs_mount.c:247 jfs_remount+0x3db/0x710 fs/jfs/super.c:454 reconfigure_super+0x3bc/0x7b0 fs/super.c:935 vfs_fsconfig_locked fs/fsopen.c:254 [inline]
__do_sys_fsconfig fs/fsopen.c:439 [inline]
__se_sys_fsconfig+0xad5/0x1060 fs/fsopen.c:314 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...]
JFS_SBI(ipbmap->i_sb)->bmap wasn't set to NULL after kfree() in dbUnmount().
Syzkaller uses faultinject to reproduce this KASAN double-free warning. The issue is triggered if either diMount() or dbMount() fail in jfs_remount(), since diUnmount() or dbUnmount() already happened in such a case - they will do double-free on next execution: jfs_umount or jfs_remount.
Tested on both upstream and jfs-next by syzkaller.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 01/03/2026
The vulnerability described in CVE-2023-54127 represents a critical double-free error within the JFS (Journaled File System) implementation of the Linux kernel. This flaw manifests during the remount operation of a JFS filesystem, specifically when the jfs_remount() function fails. The issue arises from improper memory management within the dbUnmount() function, where allocated memory is freed without proper nullification of associated pointers, leading to a scenario where the same memory block is freed twice. The vulnerability was identified through systematic testing using Syzkaller, an automated fuzzer that employs fault injection techniques to trigger kernel memory corruption issues. The KASAN (Kernel Address Sanitizer) subsystem detected this double-free condition, which occurs in the SLUB memory allocator at mm/slub.c, indicating a fundamental flaw in how memory deallocation is handled during filesystem remount operations.
The technical root cause of this vulnerability lies in the failure to properly manage the bmap pointer within the JFS superblock information structure. When jfs_remount() encounters a failure during either diMount() or dbMount() operations, the system proceeds to execute dbUnmount() which frees memory but fails to set JFS_SBI(ipbmap->i_sb)->bmap to NULL. This oversight creates a dangerous state where subsequent calls to jfs_umount() or jfs_remount() will attempt to free the same memory block again, resulting in a double-free condition. The call trace demonstrates a clear path from the remount operation through the mount and unmount functions, ultimately leading to the memory corruption. This behavior aligns with CWE-415, which describes double-free vulnerabilities that occur when the same memory block is freed twice, and is classified under the broader category of memory safety issues in kernel code. The vulnerability is particularly concerning as it can be exploited to cause system instability or potentially enable privilege escalation attacks.
The operational impact of this vulnerability extends beyond simple system crashes, as it represents a potential security risk within kernel memory management. The double-free condition can lead to memory corruption that may be exploitable by malicious actors, particularly in environments where unprivileged users have the ability to mount and remount filesystems. When the system attempts to free already-released memory, it can corrupt the heap structure and potentially allow attackers to manipulate kernel memory layout. This type of vulnerability can be leveraged to bypass security mechanisms or cause denial of service conditions that are difficult to detect and mitigate. The issue affects both upstream Linux kernel releases and the jfs-next development branch, indicating it is a persistent flaw within the JFS implementation that requires immediate attention. The vulnerability is particularly relevant in enterprise environments where filesystem remount operations are common and where kernel memory safety is critical for overall system stability and security.
Mitigation strategies for CVE-2023-54127 should focus on implementing proper memory management practices within the JFS subsystem. The most direct approach involves modifying the dbUnmount() function to ensure that JFS_SBI(ipbmap->i_sb)->bmap is explicitly set to NULL after memory deallocation, preventing subsequent double-free attempts. Kernel developers should also implement additional validation checks during filesystem remount operations to detect and abort operations that would lead to inconsistent memory states. System administrators should ensure that the Linux kernel is updated to versions containing the patched JFS implementation, as this vulnerability directly impacts the integrity of filesystem operations. The fix should be accompanied by comprehensive testing to ensure that no regressions are introduced in normal filesystem operations, while also verifying that the memory management patterns are consistent with established kernel coding practices. Additionally, monitoring and logging should be enhanced to detect anomalous filesystem remount behavior that could indicate exploitation attempts. This vulnerability serves as a reminder of the critical importance of proper memory management in kernel space and the potential for seemingly minor flaws to create significant security risks.