diff mbox series

[v4,6/8] cve-exclusions: set status for CVE-2023-3397

Message ID 20260824042123.1456876-7-junjie.cao@linux.dev
State New
Headers show
Series cve-exclusions: triage eight kernel CVEs lacking upstream fix data | expand

Commit Message

Junjie Cao Aug. 24, 2026, 4:21 a.m. UTC 
txEnd() in fs/jfs/jfs_txnmgr.c reads the log pointer from the
superblock info, drops TXN_LOCK and then takes log->gclock, while
lmLogClose() can free that log during umount.

No fix has been merged. The 2023 proposal was withdrawn by its author
("I think my fix method is not a good solution"), and proposals in 2026
for similar jfs slab use-after-free races are unreviewed:

  https://lore.kernel.org/all/20230515095956.17898-1-zyytlz.wz@163.com/
  https://lore.kernel.org/all/20260505123330.2822833-1-tristmd@gmail.com/
  https://lore.kernel.org/all/20260603171620.2532527-1-jie.wang@intel.com/

A similar use-after-free was reported against 7.0-rc1 in June 2026,
with the free stack in lmLogClose() via jfs_umount(), and syzbot has
an open slab use-after-free write in lmLogSync(); the txEnd() sequence
is unchanged in linux-next 20260727:

  https://lore.kernel.org/all/6a3eedfa.fd822575.2d6b21.e180@mx.google.com/
  https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb

CC: Paul Barker <paul@pbarker.dev>
AI-Generated: Uses Claude (claude-opus-5)
Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
---
v4:
- describe the 2026 proposals and reports as similar races rather than
  the same one; drop the kernel-cache configuration paragraph; use the
  review's comment and status wording
- name the open syzbot bug as the lmLogSync write rather than the
  txEnd write

v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/

 meta/recipes-kernel/linux/cve-exclusion.inc | 9 +++++++++
 1 file changed, 9 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index 4318fc79..a133bf08 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -231,3 +231,12 @@  CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17"
 # https://security-tracker.debian.org/tracker/CVE-2022-4543
 # https://ubuntu.com/security/CVE-2022-4543
 CVE_STATUS[CVE-2022-4543] = "unpatched: No fix has been proposed"
+
+# Triaged August 2026 - Originally proposed fix was withdrawn, similar
+# slab-use-after-free appears to have been re-found by syzkaller in 2026.
+# Unfixed in Debian, "needs evaluation" in Ubuntu.
+# https://lore.kernel.org/lkml/CAJedcCzmx02bfa22QezE8mu-iDsSdSy_oApT2ozCWO8O-8MJEQ@mail.gmail.com/
+# https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb
+# https://security-tracker.debian.org/tracker/CVE-2023-3397
+# https://ubuntu.com/security/CVE-2023-3397
+CVE_STATUS[CVE-2023-3397] = "unpatched: Proposed fix was withdrawn"