CVE-2023-53538

A tree modification logging error was found in the Linux kernel's Btrfs filesystem in the node balancing logic. A local user can trigger this issue during filesystem operations that cause internal B-tree rebalancing, where the code fails to log certain move operations in the tree modification log. This causes tree history replay to reference uninitialized memory containing garbage data, leading to invalid extent lookups, kernel panics, and denial of service.

Btrfs maintains a tree modification log to support historical tree queries, which are used by features like logical inode resolution and backref walking. When internal B-tree nodes need rebalancing, the filesystem may shift elements between sibling nodes through operations like balance_node_right and push_node_left. These operations should log their modifications so the tree can be rewound to earlier states. However, there's a subtle interaction: balance_node_right logs a MOVE operation, then push_node_left copies elements and shifts others—but deliberately skips logging the second move to avoid double-logging the copied elements. Unfortunately, this leaves out a critical move operation. When the tree mod log gets replayed (rewound), it reconstructs the historical tree state by reversing logged operations. The missing move operation causes the replay to memmove data from never-initialized memory regions, filling slots with garbage, often all zeros. If a search then uses one of these corrupted slots, it tries to read extent buffers at bogus addresses like offset 0, triggering panics in the extent mapping code. This race is quite rare and depends on specific timing during concurrent tree operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.