Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-53862— hfs: fix missing hfs_bnode_get() in __hfs_bnode_create

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于缺少hfs_bnode_get调用，可能导致内核BUG。

CVSS 7.8 · High EPSS 0.19% · P8

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 062af3e9930762d1fd22946748d34e0d859e4a8e affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 3a9065a33988c02789722be612f7c42fb8ebbb22 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< eda6879272e4df5456afc36642052ea066f58410 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< dc9f78b6d254427a06e568f2887b1011ef3143ef affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 2cab8db14566cf6a516c1f103a60cf6b7f54b1e5 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 8140cdc57bc5844cd5e1392673ec2dbf8fdc6940 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 38d72e6604b9f96dffcc0565090cc01622a37b2a affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a9dc087fd3c484fd1ed18c5efb290efaaf44ce03 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-53862

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: hfs: fix missing hfs_bnode_get() in __hfs_bnode_create Syzbot found a kernel BUG in hfs_bnode_put(): kernel BUG at fs/hfs/bnode.c:466! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3634 Comm: kworker/u4:5 Not tainted 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: writeback wb_workfn (flush-7:0) RIP: 0010:hfs_bnode_put+0x46f/0x480 fs/hfs/bnode.c:466 Code: 8a 80 ff e9 73 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a0 fe ff ff 48 89 df e8 db 8a 80 ff e9 93 fe ff ff e8 a1 68 2c ff <0f> 0b e8 9a 68 2c ff 0f 0b 0f 1f 84 00 00 00 00 00 55 41 57 41 56 RSP: 0018:ffffc90003b4f258 EFLAGS: 00010293 RAX: ffffffff825e318f RBX: 0000000000000000 RCX: ffff8880739dd7c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003b4f430 R08: ffffffff825e2d9b R09: ffffed10045157d1 R10: ffffed10045157d1 R11: 1ffff110045157d0 R12: ffff8880228abe80 R13: ffff88807016c000 R14: dffffc0000000000 R15: ffff8880228abe00 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa6ebe88718 CR3: 000000001e93d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> hfs_write_inode+0x1bc/0xb40 write_inode fs/fs-writeback.c:1440 [inline] __writeback_single_inode+0x4d6/0x670 fs/fs-writeback.c:1652 writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1878 __writeback_inodes_wb+0x125/0x420 fs/fs-writeback.c:1949 wb_writeback+0x440/0x7b0 fs/fs-writeback.c:2054 wb_check_start_all fs/fs-writeback.c:2176 [inline] wb_do_writeback fs/fs-writeback.c:2202 [inline] wb_workfn+0x827/0xef0 fs/fs-writeback.c:2235 process_one_work+0x877/0xdb0 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> The BUG_ON() is triggered at here: /* Dispose of resources used by a node */ void hfs_bnode_put(struct hfs_bnode *node) { if (node) { <skipped> BUG_ON(!atomic_read(&node->refcnt)); <- we have issue here!!!! <skipped> } } By tracing the refcnt, I found the node is created by hfs_bmap_alloc() with refcnt 1. Then the node is used by hfs_btree_write(). There is a missing of hfs_bnode_get() after find the node. The issue happened in following path: <alloc> hfs_bmap_alloc hfs_bnode_find __hfs_bnode_create <- allocate a new node with refcnt 1. hfs_bnode_put <- decrease the refcnt <write> hfs_btree_write hfs_bnode_find __hfs_bnode_create hfs_bnode_findhash <- find the node without refcnt increased. hfs_bnode_put <- trigger the BUG_ON() since refcnt is 0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于缺少hfs_bnode_get调用，可能导致内核BUG。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ 062af3e9930762d1fd22946748d34e0d859e4a8e -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2023-53862

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-53862

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-12-09 · 152 CVEs total

CVE-2025-40343 9.8 CRITICAL nvmet-fc: avoid scheduling association deletion twice
CVE-2022-50666 9.8 CRITICAL RDMA/siw: Fix QP destroy to wait for all references dropped.
CVE-2023-53794 9.8 CRITICAL cifs: fix session state check in reconnect to avoid use-after-free issue
CVE-2025-40336 8.8 HIGH drm/gpusvm: fix hmm_pfn_to_map_order() usage
CVE-2023-53822 8.8 HIGH wifi: ath11k: Ignore frags from uninitialized peer in dp.
CVE-2025-40328 8.8 HIGH smb: client: fix potential UAF in smb2_close_cached_fid()
CVE-2023-53785 8.8 HIGH mt76: mt7921: don't assume adequate headroom for SDIO headers
CVE-2025-40342 8.8 HIGH nvme-fc: use lock accessing port_state and rport state
CVE-2023-53827 8.8 HIGH Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
CVE-2023-53851 8.4 HIGH drm/msm/dp: Drop aux devices together with DP controller
CVE-2025-40337 8.2 HIGH net: stmmac: Correctly handle Rx checksum offload errors
CVE-2023-53803 8.1 HIGH scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
CVE-2022-50656 8.1 HIGH nfc: pn533: Clear nfc_target before being used
CVE-2023-53816 7.8 HIGH drm/amdkfd: fix potential kgd_mem UAFs
CVE-2023-53790 7.8 HIGH bpf: Zeroing allocated object from slab in bpf memory allocator
CVE-2023-53819 7.8 HIGH amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
CVE-2025-40344 7.8 HIGH ASoC: Intel: avs: Disable periods-elapsed work when closing PCM
CVE-2023-53795 7.8 HIGH iommufd: IOMMUFD_DESTROY should not increase the refcount
CVE-2023-53810 7.8 HIGH blk-mq: release crypto keyslot before reporting I/O complete
CVE-2023-53806 7.8 HIGH drm/amd/display: populate subvp cmd info only for the top pipe

Showing top 20 of 152 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2023-53862

No comments yet

Leave a comment