CVE-2023-54140 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
A syzbot stress test using a corrupted disk image reported that mark_buffer_dirty() called from __nilfs_mark_inode_dirty() or nilfs_palloc_commit_alloc_entry() may output a kernel warning, and can panic if the kernel is booted with panic_on_warn.
This is because nilfs2 keeps buffer pointers in local structures for some metadata and reuses them, but such buffers may be forcibly discarded by nilfs_clear_dirty_page() in some critical situations.
This issue is reported to appear after commit 28a65b49eb53 ("nilfs2: do not write dirty data after degenerating to read-only"), but the issue has potentially existed before.
Fix this issue by checking the uptodate flag when attempting to reuse an internally held buffer, and reloading the metadata instead of reusing the buffer if the flag was lost.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 01/03/2026
The vulnerability described in CVE-2023-54140 represents a critical buffer management flaw within the Linux kernel's nilfs2 (New Implementation of Log-Structured File System 2) subsystem. This issue manifests as a kernel WARNING that can escalate to a system panic under specific conditions, demonstrating a fundamental failure in how the file system handles buffer reuse operations during metadata management. The vulnerability was identified through syzbot, an automated fuzzer that systematically tests kernel code for stability issues, indicating that this flaw can be triggered through stress testing scenarios involving corrupted disk images.
The technical root cause of this vulnerability lies in the improper handling of buffer pointers within nilfs2's internal metadata structures. When the file system attempts to mark buffers as dirty for metadata operations, it maintains references to these buffers in local structures for reuse purposes. However, the system fails to properly validate whether these buffers remain valid for reuse when they have been forcibly discarded by the nilfs_clear_dirty_page() function during critical situations. This buffer reuse pattern creates a scenario where stale buffer references are used, leading to inconsistent states that trigger kernel warnings and potential system crashes. The vulnerability specifically affects the mark_buffer_dirty() function when called from either __nilfs_mark_inode_dirty() or nilfs_palloc_commit_alloc_entry() contexts, both of which are critical paths in the file system's metadata management operations.
The operational impact of this vulnerability extends beyond simple kernel warnings to potentially destabilize entire systems running with the nilfs2 file system. When a kernel is configured with panic_on_warn enabled, which is common in production environments for strict error handling, this vulnerability can cause immediate system panics that result in unplanned reboots and potential data loss. The issue's occurrence after commit 28a65b49eb53 suggests that recent changes to the read-only degeneration logic inadvertently introduced or exposed this buffer management flaw, though the underlying problem likely existed in earlier versions. This makes the vulnerability particularly concerning as it could affect systems that have been running stable versions for extended periods without detection.
The fix implemented addresses this issue by introducing proper validation of the uptodate flag before attempting to reuse internally held buffers. This approach aligns with established security practices for buffer management and memory safety, ensuring that buffer reuse operations only occur when the underlying data remains valid and consistent. The solution prevents the use of stale buffer references by reloading the necessary metadata when the uptodate flag indicates that the buffer content has been lost, thereby maintaining data integrity in the file system's metadata operations. This remediation approach follows principles similar to those recommended in CWE-129 and CWE-131 categories related to improper validation of buffer boundaries and memory access violations, while also addressing potential attack vectors that could exploit this condition to cause denial of service or system instability through carefully crafted stress testing scenarios.