CVE-2023-53584

A race condition was found in the Linux kernel's UBIFS filesystem in the page release logic. A local user can trigger this issue through concurrent file operations including writes, truncation, and cache invalidation, causing pages to become private but not dirty due to timing of dirty flag clearing and size updates. This results in hitting an assertion in ubifs_releasepage when the filesystem attempts to release pages in an unexpected state, leading to filesystem errors and denial of service.

The race occurs across three concurrent operations: Process A writes and dirties a page with UBIFS private data, then clears the dirty flag during writeback. Process B truncates the file to zero size. Process A checks the new file size, finds the page is now beyond EOF, and unlocks it without finishing writeback—leaving it private but not dirty. Process C then calls fadvise which attempts to invalidate the page, calling ubifs_releasepage on a private, non-dirty page. This state violates the driver's assumption that private pages are always dirty, triggering an assertion that switches the filesystem to read-only mode. The race window requires precise timing between write, truncate, and fadvise operations, but can occur during normal concurrent filesystem use.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.