CVE-2023-53222: linux kernel Out-of-bounds Read — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting. Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181. Thus, make sure that db_l2nbperpage is correct while mounting. Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size) => Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE

Is your site exposed to CVE-2023-53222?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness Type (CWE)

CWE-125 Out-of-bounds Read

Affected Products

Vendor	Product	Versions
linux	linux_kernel	< 4.14.322
linux	linux_kernel	4.15 — 4.19.291
linux	linux_kernel	4.20 — 5.4.251
linux	linux_kernel	5.5 — 5.10.188
linux	linux_kernel	5.11 — 5.15.121
linux	linux_kernel	5.16 — 6.1.40
linux	linux_kernel	6.2 — 6.4.5

References

Advisories & Patches

https://git.kernel.org/stable/c/11509910c599cbd04585ec35a6d5e1a0053d84c1 https://git.kernel.org/stable/c/2a03c4e683d33d17b667418eb717b13dda1fac6b https://git.kernel.org/stable/c/47b7eaae08e8b2f25bdf37bc14d21be090bcb20f https://git.kernel.org/stable/c/8c1efe3f74a7864461b0dff281c5562154b4aa8e https://git.kernel.org/stable/c/a4855aeb13e4ad1f23e16753b68212e180f7d848 https://git.kernel.org/stable/c/c7feb54b113802d2aba98708769d3c33fb017254 https://git.kernel.org/stable/c/de984faecddb900fa850af4df574a25b32bb93f5 https://git.kernel.org/stable/c/ef5c205b6e6f8d1f18ef0b4a9832b1b5fa85f7f2

Frequently Asked Questions

What is CVE-2023-53222? +

In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting. Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181. Thus, make sure that db_l2nbperpage is correct while mounting. Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size) => Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE It has a CVSS v3.1 base score of 7.1 (HIGH).

How severe is CVE-2023-53222? +

CVE-2023-53222 has a CVSS v3.1 score of 7.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2023-53222? +

CVE-2023-53222 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-53222? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-29013

libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() …

CVE-2026-3508

An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system …

CVE-2025-48520

An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read …

CVE-2026-3894

Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.This issue affects Connext Professional: from 7.4.0 before 7.7.0, …

CVE-2025-4098

Horner Automation Cscape version 10.0 (10.0.415.2) SP1 is vulnerable to an out-of-bounds read vulnerability that could allow an attacker to …

CVE-2025-49849

An Out-of-bounds Read vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation …

CVE-2023-53222