{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2023-54127",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2023-54127"
  ],
  "published": "2025-12-24T13:11:50Z",
  "summary": "fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()\n\nSyzkaller reported the following issue:\n==================================================================\nBUG: KASAN: double-free in slab_free mm/slub.c:3787 [inline]\nBUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3800\nFree of addr ffff888086408000 by task syz-executor.4/12750\n[...]\nCall Trace:\n <TASK>\n[...]\n kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:482\n ____kasan_slab_free+0xfb/0x120\n kasan_slab_free include/linux/kasan.h:177 [inline]\n slab_free_hook mm/slub.c:1781 [inline]\n slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807\n slab_free mm/slub.c:3787 [inline]\n __kmem_cache_free+0x71/0x110 mm/slub.c:3800\n dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264\n jfs_umount+0x248/0x3b0 fs/jfs/jfs_umount.c:87\n jfs_put_super+0x86/0x190 fs/jfs/super.c:194\n generic_shutdown_super+0x130/0x310 fs/super.c:492\n kill_block_super+0x79/0xd0 fs/super.c:1386\n deactivate_locked_super+0xa7/0xf0 fs/super.c:332\n cleanup_mnt+0x494/0x520 fs/namespace.c:1291\n task_work_run+0x243/0x300 kernel/task_work.c:179\n resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]\n exit_to_user_mode_loop+0x124/0x150 kernel/entry/common.c:171\n exit_to_user_mode_prepare+0xb2/0x140 kernel/entry/common.c:203\n __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]\n syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:296\n do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[...]\n </TASK>\n\nAllocated by task 13352:\n kasan_save_stack mm/kasan/common.c:45 [inline]\n kasan_set_track+0x3d/0x60 mm/kasan/common.c:52\n ____kasan_kmalloc mm/kasan/common.c:371 [inline]\n __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380\n kmalloc include/linux/slab.h:580 [inline]\n dbMount+0x54/0x980 fs/jfs/jfs_dmap.c:164\n jfs_mount+0x1dd/0x830 fs/jfs/jfs_mount.c:121\n jfs_fill_super+0x590/0xc50 fs/jfs/super.c:556\n mount_bdev+0x26c/0x3a0 fs/super.c:1359\n legacy_get_tree+0xea/0x180 fs/fs_context.c:610\n vfs_get_tree+0x88/0x270 fs/super.c:1489\n do_new_mount+0x289/0xad0 fs/namespace.c:3145\n do_mount fs/namespace.c:3488 [inline]\n __do_sys_mount fs/namespace.c:3697 [inline]\n __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nFreed by task 13352:\n kasan_save_stack mm/kasan/common.c:45 [inline]\n kasan_set_track+0x3d/0x60 mm/kasan/common.c:52\n kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518\n ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236\n kasan_slab_free include/linux/kasan.h:177 [inline]\n slab_free_hook mm/slub.c:1781 [inline]\n slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807\n slab_free mm/slub.c:3787 [inline]\n __kmem_cache_free+0x71/0x110 mm/slub.c:3800\n dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264\n jfs_mount_rw+0x545/0x740 fs/jfs/jfs_mount.c:247\n jfs_remount+0x3db/0x710 fs/jfs/super.c:454\n reconfigure_super+0x3bc/0x7b0 fs/super.c:935\n vfs_fsconfig_locked fs/fsopen.c:254 [inline]\n __do_sys_fsconfig fs/fsopen.c:439 [inline]\n __se_sys_fsconfig+0xad5/0x1060 fs/fsopen.c:314\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[...]\n\nJFS_SBI(ipbmap->i_sb)->bmap wasn't set to NULL after kfree() in\ndbUnmount().\n\nSyzkaller uses faultinject to reproduce this KASAN double-free\nwarning. The issue is triggered if either diMount() or dbMount() fail\nin jfs_remount(), since diUnmount() or dbUnmount() already happened in\nsuch a case - they will do double-free on next execution: jfs_umount\nor jfs_remount.\n\nTested on both upstream and jfs-next by syzkaller.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.21-1+rpt1",
        "1:6.1.47-1+rpt2",
        "1:6.1.47-1+rpt4",
        "1:6.1.54-1+rpt2"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v6",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7l",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v8",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi2-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi2-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi2-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi2-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi4-rpi-2712",
            "binary_version": "1:6.1.54-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi4-rpi-v6",
            "binary_version": "1:6.1.54-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi4-rpi-v7",
            "binary_version": "1:6.1.54-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi4-rpi-v7l",
            "binary_version": "1:6.1.54-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi4-rpi-v8",
            "binary_version": "1:6.1.54-1+rpt2"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.21-1+rpt1": {
            "linux_commit": "0afb5e98488aed7017b9bf321b575d0177feb7ed",
            "upstream_version": "6.1.21",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.55"
          },
          "1:6.1.47-1+rpt2": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.55"
          },
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.55",
            "compiled_filter": false
          },
          "1:6.1.54-1+rpt2": {
            "linux_commit": "2906f7abdc03d4a92b6b0e2e0c87ea2a9dffe8f7",
            "upstream_version": "6.1.54",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.55"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54127"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/798c5f6f98bc9045593d4b3a65c32f05d97bd0e6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/aef6507e85475e30831c30405d785c7ed976ea4a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b12ccbfdf6539ef0157868f69fcae0b7f7a072b3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6f8b34458948ffca2fe90cd8c614e3fa2ebe0b27"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/aa5b019a3e0f7f54f4e5370c1af827f6b00fd26b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2f7a36448f51d08d3a83f1514abcca4b680bcd3c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f71c4bb3ec08dfcbd201350a6a0a914c4e6a9e3f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cade5397e5461295f3cb87880534b6a07cafa427"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:24:39Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerability is reached only through local filesystem syscalls \u2014 mount(2)/fsconfig(2) remount of a JFS block device followed by umount \u2014 with an attacker-supplied or attacker-modifiable image on removable/loop media. No network or adjacent-network path exists into JFS mount handling.\nAC:L - The attacker deterministically forces dbMount() to fail on the remount re-read, because jfs_mount_rw() calls truncate_inode_pages() on ipbmap first: mutating the backing store so the bmap descriptor fails the sanity checks yields -EINVAL, and truncating it yields -EIO from read_metapage(). No race and no condition outside the attacker's control is involved.\nPR:L - Untrusted JFS media is routinely mounted and remounted on behalf of unprivileged users on kiosks, embedded/automotive and Android-class devices via udisks/autofs and mount-ro-then-remount-rw boot flows, and semi-privileged container/service contexts can drive the same path; consistent with sibling JFS crafted-image CVEs, a low-privileged local actor is assumed rather than full init-namespace root.\nUI:N - The attacker drives the whole sequence \u2014 mount read-only, remount read-write with a poisoned/erroring backing store, then unmount \u2014 with no victim action required at any step.\nS:U - The freed struct bmap, the slab it lives in, and all corrupted state belong to the kernel's own memory-management authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Before the second kfree(), dbSync() reads the already-freed bmap and writes over a kilobyte of its contents \u2014 including all 128 db_agfree[] entries \u2014 into the on-disk bmap descriptor, which the attacker reads back from the device, leaking freed kernel heap memory; the double-free itself further yields arbitrary read via overlapping allocations.\nI:H - A double-free of a ~1.6 KiB object in the sprayable kmalloc-2k cache lets the attacker reclaim it and hand two owners the same allocation, a classic type-confusion path to arbitrary kernel write; additionally, since jfs_remount() clears SB_RDONLY even on failure, dbAlloc()/dbFree() subsequently write through the dangling bmap pointer.\nA:H - The bug was reported by syzbot as a KASAN double-free that corrupts SLUB freelist state; with freelist hardening or slub_debug this is an immediate kernel panic, and unchecked it produces allocator corruption and crashes."
    }
  }
}