CVE-2023-53804

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()

During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). However, since nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may cause use-after-free read if inodes are left in "garbage_list" and released by nilfs_dispose_list() at the end of nilfs_detach_log_writer().

Fix this issue by modifying nilfs_evict_inode() to only clear inode without additional metadata changes that use nilfs_root if the file system is degraded to read-only or the writer is detached.

This vulnerability presents no operational impact for Red Hat Enterprise Linux environments because the NILFS2 file system module is neither built nor shipped with Red Hat enterprise kernels. In upstream kernels where this filesystem is enabled, local users performing unmount operations could trigger memory corruption through a use-after-free condition during inode teardown. Because the underlying code is entirely absent from Red Hat enterprise products, no exposure exists for supported installations.