{"id":"DEBIAN-CVE-2023-53247","details":"In the Linux kernel, the following vulnerability has been resolved:  btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand  While trying to get the subpage blocksize tests running, I hit the following panic on generic/476    assertion failed: PagePrivate(page) && page-\u003eprivate, in fs/btrfs/subpage.c:229   kernel BUG at fs/btrfs/subpage.c:229!   Internal error: Oops - BUG: 00000000f2000800 [#1] SMP   CPU: 1 PID: 1453 Comm: fsstress Not tainted 6.4.0-rc7+ #12   Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20230301gitf80f052277c8-26.fc38 03/01/2023   pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)   pc : btrfs_subpage_assert+0xbc/0xf0   lr : btrfs_subpage_assert+0xbc/0xf0   Call trace:    btrfs_subpage_assert+0xbc/0xf0    btrfs_subpage_clear_checked+0x38/0xc0    btrfs_page_clear_checked+0x48/0x98    btrfs_truncate_block+0x5d0/0x6a8    btrfs_cont_expand+0x5c/0x528    btrfs_write_check.isra.0+0xf8/0x150    btrfs_buffered_write+0xb4/0x760    btrfs_do_write_iter+0x2f8/0x4b0    btrfs_file_write_iter+0x1c/0x30    do_iter_readv_writev+0xc8/0x158    do_iter_write+0x9c/0x210    vfs_iter_write+0x24/0x40    iter_file_splice_write+0x224/0x390    direct_splice_actor+0x38/0x68    splice_direct_to_actor+0x12c/0x260    do_splice_direct+0x90/0xe8    generic_copy_file_range+0x50/0x90    vfs_copy_file_range+0x29c/0x470    __arm64_sys_copy_file_range+0xcc/0x498    invoke_syscall.constprop.0+0x80/0xd8    do_el0_svc+0x6c/0x168    el0_svc+0x50/0x1b0    el0t_64_sync_handler+0x114/0x120    el0t_64_sync+0x194/0x198  This happens because during btrfs_cont_expand we'll get a page, set it as mapped, and if it's not Uptodate we'll read it.  However between the read and re-locking the page we could have called release_folio() on the page, but left the page in the file mapping.  release_folio() can clear the page private, and thus further down we blow up when we go to modify the subpage bits.  Fix this by putting the set_page_extent_mapped() after the read.  This is safe because read_folio() will call set_page_extent_mapped() before it does the read, and then if we clear page private but leave it on the mapping we're completely safe re-setting set_page_extent_mapped().  With this patch I can now run generic/476 without panicing.","modified":"2026-09-15T09:02:50.851770213Z","published":"2025-09-15T15:15:51.930Z","upstream":["CVE-2023-53247"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53247"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.52-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53247.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53247.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53247.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}