CVE-2023-53846

A use-after-free vulnerability was found in the F2FS filesystem in the Linux kernel. The truncate_dnode() function lacks proper sanity checks on direct node pages, allowing a corrupted filesystem where one inode incorrectly references another inode's node to trigger out-of-bounds memory access during truncation operations.

Triggering this flaw requires a maliciously crafted or corrupted F2FS filesystem image. F2FS is primarily used on mobile devices and flash storage, which limits exposure in typical enterprise environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.