{"cve":"CVE-2023-53537","nvd":{"published":"2025-10-04T16:15:48.697","modified":"2026-08-04T10:19:11.177","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid use-after-free for cached IPU bio\n\nxfstest generic/019 reports a bug:\n\nkernel BUG at mm/filemap.c:1619!\nRIP: 0010:folio_end_writeback+0x8a/0x90\nCall Trace:\n end_page_writeback+0x1c/0x60\n f2fs_write_end_io+0x199/0x420\n bio_endio+0x104/0x180\n submit_bio_noacct+0xa5/0x510\n submit_bio+0x48/0x80\n f2fs_submit_write_bio+0x35/0x300\n f2fs_submit_merged_ipu_write+0x2a0/0x2b0\n f2fs_write_single_data_page+0x838/0x8b0\n f2fs_write_cache_pages+0x379/0xa30\n f2fs_write_data_pages+0x30c/0x340\n do_writepages+0xd8/0x1b0\n __writeback_single_inode+0x44/0x370\n writeback_sb_inodes+0x233/0x4d0\n __writeback_inodes_wb+0x56/0xf0\n wb_writeback+0x1dd/0x2d0\n wb_workfn+0x367/0x4a0\n process_one_work+0x21d/0x430\n worker_thread+0x4e/0x3c0\n kthread+0x103/0x130\n ret_from_fork+0x2c/0x50\n\nThe root cause is: after cp_error is set, f2fs_submit_merged_ipu_write()\nin f2fs_write_single_data_page() tries to flush IPU bio in cache, however\nf2fs_submit_merged_ipu_write() missed to check validity of @bio parameter,\nresult in submitting random cached bio which belong to other IO context,\nthen it will cause use-after-free issue, fix it by adding additional\nvalidity check.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/5cdb422c839134273866208dad5360835ddb9794","https://git.kernel.org/stable/c/7d058f0ab161437369ad6e45a4b67c2886e71373","https://git.kernel.org/stable/c/97ec6f1788cc6bee3f8c89cb908e1a2a1cd859bb","https://git.kernel.org/stable/c/9a7f63283af6befc0f91d549f4f6917dff7479a9","https://git.kernel.org/stable/c/af4ce124d7bd74cb839bbdaccffbb416771a56b5"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:11:26.888974865+00:00"},"epss":{"cve":"CVE-2023-53537","score":0.00164,"percentile":0.05553,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}