{"id":"DEBIAN-CVE-2023-54127","details":"In the Linux kernel, the following vulnerability has been resolved:  fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()  Syzkaller reported the following issue: ================================================================== BUG: KASAN: double-free in slab_free mm/slub.c:3787 [inline] BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3800 Free of addr ffff888086408000 by task syz-executor.4/12750 [...] Call Trace:  \u003cTASK\u003e [...]  kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:482  ____kasan_slab_free+0xfb/0x120  kasan_slab_free include/linux/kasan.h:177 [inline]  slab_free_hook mm/slub.c:1781 [inline]  slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807  slab_free mm/slub.c:3787 [inline]  __kmem_cache_free+0x71/0x110 mm/slub.c:3800  dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264  jfs_umount+0x248/0x3b0 fs/jfs/jfs_umount.c:87  jfs_put_super+0x86/0x190 fs/jfs/super.c:194  generic_shutdown_super+0x130/0x310 fs/super.c:492  kill_block_super+0x79/0xd0 fs/super.c:1386  deactivate_locked_super+0xa7/0xf0 fs/super.c:332  cleanup_mnt+0x494/0x520 fs/namespace.c:1291  task_work_run+0x243/0x300 kernel/task_work.c:179  resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]  exit_to_user_mode_loop+0x124/0x150 kernel/entry/common.c:171  exit_to_user_mode_prepare+0xb2/0x140 kernel/entry/common.c:203  __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]  syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:296  do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86  entry_SYSCALL_64_after_hwframe+0x63/0xcd [...]  \u003c/TASK\u003e  Allocated by task 13352:  kasan_save_stack mm/kasan/common.c:45 [inline]  kasan_set_track+0x3d/0x60 mm/kasan/common.c:52  ____kasan_kmalloc mm/kasan/common.c:371 [inline]  __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380  kmalloc include/linux/slab.h:580 [inline]  dbMount+0x54/0x980 fs/jfs/jfs_dmap.c:164  jfs_mount+0x1dd/0x830 fs/jfs/jfs_mount.c:121  jfs_fill_super+0x590/0xc50 fs/jfs/super.c:556  mount_bdev+0x26c/0x3a0 fs/super.c:1359  legacy_get_tree+0xea/0x180 fs/fs_context.c:610  vfs_get_tree+0x88/0x270 fs/super.c:1489  do_new_mount+0x289/0xad0 fs/namespace.c:3145  do_mount fs/namespace.c:3488 [inline]  __do_sys_mount fs/namespace.c:3697 [inline]  __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x63/0xcd  Freed by task 13352:  kasan_save_stack mm/kasan/common.c:45 [inline]  kasan_set_track+0x3d/0x60 mm/kasan/common.c:52  kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518  ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236  kasan_slab_free include/linux/kasan.h:177 [inline]  slab_free_hook mm/slub.c:1781 [inline]  slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807  slab_free mm/slub.c:3787 [inline]  __kmem_cache_free+0x71/0x110 mm/slub.c:3800  dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264  jfs_mount_rw+0x545/0x740 fs/jfs/jfs_mount.c:247  jfs_remount+0x3db/0x710 fs/jfs/super.c:454  reconfigure_super+0x3bc/0x7b0 fs/super.c:935  vfs_fsconfig_locked fs/fsopen.c:254 [inline]  __do_sys_fsconfig fs/fsopen.c:439 [inline]  __se_sys_fsconfig+0xad5/0x1060 fs/fsopen.c:314  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x63/0xcd [...]  JFS_SBI(ipbmap-\u003ei_sb)-\u003ebmap wasn't set to NULL after kfree() in dbUnmount().  Syzkaller uses faultinject to reproduce this KASAN double-free warning. The issue is triggered if either diMount() or dbMount() fail in jfs_remount(), since diUnmount() or dbUnmount() already happened in such a case - they will do double-free on next execution: jfs_umount or jfs_remount.  Tested on both upstream and jfs-next by syzkaller.","modified":"2026-09-15T09:02:52.816114650Z","published":"2025-12-24T13:16:14.680Z","upstream":["CVE-2023-54127"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-54127"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.55-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54127.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54127.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54127.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}