CVE-2023-53537

A use-after-free flaw was found in the Linux kernel's F2FS filesystem in the cached IPU (In-Place Update) bio handling. A local user can trigger this issue when checkpoint errors occur during writeback, causing f2fs_submit_merged_ipu_write to submit a stale cached bio pointer that belongs to a different IO context. This results in using freed memory, triggering kernel bugs in page writeback completion, and causing denial of service through kernel crashes.

F2FS uses IPU to update data blocks in-place rather than through log-structured writes. When a checkpoint error is set, the f2fs_write_single_data_page function calls f2fs_submit_merged_ipu_write to flush any pending IPU writes. However, this function fails to validate the bio parameter before submission. If the cached bio pointer is stale or belongs to another IO context, submitting it causes use-after-free when the bio completion handler tries to end page writeback on pages that may have already been freed or belong to other operations. The issue manifests as "Bad page map" warnings and kernel BUGs in folio_end_writeback. Triggering requires F2FS filesystems under conditions that set cp_error, such as during error recovery or stress testing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.