CVE-2023-53222
published 2025-09-15CVE-2023-53222: In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap.c at line 381, BLKTODMAP…
PriorityP429high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.15%
4.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
jfs: jfs_dmap: Validate db_l2nbperpage while mounting
In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block
number inside dbFree(). db_l2nbperpage, which is the log2 number of
blocks per page, is passed as an argument to BLKTODMAP which uses it
for shifting.
Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is
too big. This happens because the large value is set without any
validation in dbMount() at line 181.
Thus, make sure that db_l2nbperpage is correct while mounting.
Max number of blocks per page = Page size / Min block size
=> log2(Max num_block per page) = log2(Page size / Min block size)
= log2(Page size) - log2(Min block size)
=> Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8c1efe3f74a7864461b0dff281c5562154b4aa8e | 8c1efe3f74a7864461b0dff281c5562154b4aa8e |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ef5c205b6e6f8d1f18ef0b4a9832b1b5fa85f7f2 | ef5c205b6e6f8d1f18ef0b4a9832b1b5fa85f7f2 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a4855aeb13e4ad1f23e16753b68212e180f7d848 | a4855aeb13e4ad1f23e16753b68212e180f7d848 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 47b7eaae08e8b2f25bdf37bc14d21be090bcb20f | 47b7eaae08e8b2f25bdf37bc14d21be090bcb20f |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < de984faecddb900fa850af4df574a25b32bb93f5 | de984faecddb900fa850af4df574a25b32bb93f5 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c7feb54b113802d2aba98708769d3c33fb017254 | c7feb54b113802d2aba98708769d3c33fb017254 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2a03c4e683d33d17b667418eb717b13dda1fac6b | 2a03c4e683d33d17b667418eb717b13dda1fac6b |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 11509910c599cbd04585ec35a6d5e1a0053d84c1 | 11509910c599cbd04585ec35a6d5e1a0053d84c1 |
| linux | linux_kernel | < 4.14.322 | 4.14.322 |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 4.15 < 4.19.291 | 4.19.291 |
| linux | linux_kernel | >= 4.20 < 5.4.251 | 5.4.251 |
| linux | linux_kernel | >= 5.11 < 5.15.121 | 5.15.121 |
| linux | linux_kernel | >= 5.16 < 6.1.40 | 6.1.40 |
| linux | linux_kernel | >= 5.5 < 5.10.188 | 5.10.188 |
| linux | linux_kernel | >= 6.2 < 6.4.5 | 6.4.5 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-53222: In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap
osv·2025-09-15·CVSS 7.1
CVE-2023-53222 [HIGH] CVE-2023-53222: In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap
In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting. Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181. Thus, make sure that db_l2nbperpage is correct while mounting. Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size) => Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE
GHSA
GHSA-3277-7c79-2vxw: In the Linux kernel, the following vulnerability has been resolved:
jfs: jfs_dmap: Validate db_l2nbperpage while mounting
In jfs_dmap
ghsa_unreviewed·2025-09-15
CVE-2023-53222 [HIGH] CWE-125 GHSA-3277-7c79-2vxw: In the Linux kernel, the following vulnerability has been resolved:
jfs: jfs_dmap: Validate db_l2nbperpage while mounting
In jfs_dmap
In the Linux kernel, the following vulnerability has been resolved:
jfs: jfs_dmap: Validate db_l2nbperpage while mounting
In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block
number inside dbFree(). db_l2nbperpage, which is the log2 number of
blocks per page, is passed as an argument to BLKTODMAP which uses it
for shifting.
Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is
too big. This happens because the large value is set without any
validation in dbMount() at line 181.
Thus, make sure that db_l2nbperpage is correct while mounting.
Max number of blocks per page = Page size / Min block size
=> log2(Max num_block per page) = log2(Page size / Min block size)
= log2(Page size) - log2(Min block size)
=> Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE
Red Hat
kernel: jfs: jfs_dmap: Validate db_l2nbperpage while mounting
vendor_redhat·2025-09-15·CVSS 7.1
CVE-2023-53222 [HIGH] CWE-190 kernel: jfs: jfs_dmap: Validate db_l2nbperpage while mounting
kernel: jfs: jfs_dmap: Validate db_l2nbperpage while mounting
In the Linux kernel, the following vulnerability has been resolved:
jfs: jfs_dmap: Validate db_l2nbperpage while mounting
In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block
number inside dbFree(). db_l2nbperpage, which is the log2 number of
blocks per page, is passed as an argument to BLKTODMAP which uses it
for shifting.
Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is
too big. This happens because the large value is set without any
validation in dbMount() at line 181.
Thus, make sure that db_l2nbperpage is correct while mounting.
Max number of blocks per page = Page size / Min block size
=> log2(Max num_block per page) = log2(Page size / Min block size)
= log2(Page size) - log2(Min block
Debian
CVE-2023-53222: linux - In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dm...
vendor_debian·2023·CVSS 7.1
CVE-2023-53222 [HIGH] CVE-2023-53222: linux - In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dm...
In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting. Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181. Thus, make sure that db_l2nbperpage is correct while mounting. Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size) => Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE
Scope: l
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/11509910c599cbd04585ec35a6d5e1a0053d84c1https://git.kernel.org/stable/c/2a03c4e683d33d17b667418eb717b13dda1fac6bhttps://git.kernel.org/stable/c/47b7eaae08e8b2f25bdf37bc14d21be090bcb20fhttps://git.kernel.org/stable/c/8c1efe3f74a7864461b0dff281c5562154b4aa8ehttps://git.kernel.org/stable/c/a4855aeb13e4ad1f23e16753b68212e180f7d848https://git.kernel.org/stable/c/c7feb54b113802d2aba98708769d3c33fb017254https://git.kernel.org/stable/c/de984faecddb900fa850af4df574a25b32bb93f5https://git.kernel.org/stable/c/ef5c205b6e6f8d1f18ef0b4a9832b1b5fa85f7f2
2025-09-15
Published