CVE-2023-53214

f2fs: fix to avoid potential memory corruption in __update_iostat_latency()

HIGH
7.8
CVSS Score
Published: September 15, 2025 at 02:21 PM UTC
Updated: August 5, 2026 at 10:24 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential memory corruption in __update_iostat_latency() Add iotype sanity check to avoid potential memory corruption. This is to fix the compile error below: fs/f2fs/iostat.c:231 __update_iostat_latency() error: buffer overflow 'io_lat->peak_lat[type]' 3 <= 3 vim +228 fs/f2fs/iostat.c 211 static inline void __update_iostat_latency(struct bio_iostat_ctx *iostat_ctx, 212 enum iostat_lat_type type) 213 { 214 unsigned long ts_diff; 215 unsigned int page_type = iostat_ctx->type; 216 struct f2fs_sb_info *sbi = iostat_ctx->sbi; 217 struct iostat_lat_info *io_lat = sbi->iostat_io_lat; 218 unsigned long flags; 219 220 if (!sbi->iostat_enable) 221 return; 222 223 ts_diff = jiffies - iostat_ctx->submit_ts; 224 if (page_type >= META_FLUSH) ^^^^^^^^^^ 225 page_type = META; 226 227 spin_lock_irqsave(&sbi->iostat_lat_lock, flags); @228 io_lat->sum_lat[type][page_type] += ts_diff; ^^^^^^^^^ Mixup between META_FLUSH and NR_PAGE_TYPE leads to memory corruption.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.15 ≤ v < 5.15.1005.15 ≤ v < 6.1.185.15 ≤ v < 6.2.55.15 ≤ v < 6.35.16 ≤ v < 6.1.186.2 ≤ v < 6.2.55.15a4b6817625e71d5d4aee16cacf7a7fec077c6dbe
Vendor states this is fixed in 0dbbf0fb38d5ec5d4138d1aeaeb43d9217b9a592 (fixed)
Vendor states this is fixed in 20b4f3de0f3932f71b4a8daf0671e517a8d98022 (fixed)
Vendor states this is fixed in 22ddbbff116ee7dce5431feb1c0f36a507d2d68d (fixed)
Vendor states this is fixed in aa4d726af72a21732ce120484e0b1240674a13b3 (fixed)
Vendor states this is fixed in 5.15 (unaffected)
Vendor states this is fixed in 5.15.100 (unaffected)
Vendor states this is fixed in 6.1.18 (unaffected)
Vendor states this is fixed in 6.2.5 (unaffected)
Vendor states this is fixed in 6.3 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0dbbf0fb38d5ec5d4138d1aeaeb43d9217b9a592
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/20b4f3de0f3932f71b4a8daf0671e517a8d98022
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/22ddbbff116ee7dce5431feb1c0f36a507d2d68d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/aa4d726af72a21732ce120484e0b1240674a13b3

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-787

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card