{"id":"DEBIAN-CVE-2023-53311","details":"In the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput  During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer().  Previously, nilfs_evict_inode() could cause use-after-free read for nilfs_root if inodes are left in \"garbage_list\" and released by nilfs_dispose_list at the end of nilfs_detach_log_writer(), and this bug was fixed by commit 9b5a04ac3ad9 (\"nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()\").  However, it turned out that there is another possibility of UAF in the call path where mark_inode_dirty_sync() is called from iput():  nilfs_detach_log_writer()   nilfs_dispose_list()     iput()       mark_inode_dirty_sync()         __mark_inode_dirty()           nilfs_dirty_inode()             __nilfs_mark_inode_dirty()               nilfs_load_inode_block() --\u003e causes UAF of nilfs_root struct  This can happen after commit 0ae45f63d4ef (\"vfs: add support for a lazytime mount option\"), which changed iput() to call mark_inode_dirty_sync() on its final reference if i_state has I_DIRTY_TIME flag and i_nlink is non-zero.  This issue appears after commit 28a65b49eb53 (\"nilfs2: do not write dirty data after degenerating to read-only\") when using the syzbot reproducer, but the issue has potentially existed before.  Fix this issue by adding a \"purging flag\" to the nilfs structure, setting that flag while disposing the \"garbage_list\" and checking it in __nilfs_mark_inode_dirty().  Unlike commit 9b5a04ac3ad9 (\"nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()\"), this patch does not rely on ns_writer to determine whether to skip operations, so as not to break recovery on mount.  The nilfs_salvage_orphan_logs routine dirties the buffer of salvaged data before attaching the log writer, so changing __nilfs_mark_inode_dirty() to skip the operation when ns_writer is NULL will cause recovery write to fail.  The purpose of using the cleanup-only flag is to allow for narrowing of such conditions.","modified":"2026-09-15T09:02:50.937903250Z","published":"2025-09-16T17:15:36.967Z","upstream":["CVE-2023-53311"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53311"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.52-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53311.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53311.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53311.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}