CVE-2023-53447Medium· 4.7▾ Sunlit

f2fs: don't reset unchangable mount option in f2fs_remount()

In the Linux kernel, the following vulnerability has been resolved: f2fs: don't reset unchangable mount option in f2fs_remount() syzbot reports a bug as below: general protection fault, probably for non-canonical address 0xdffffc00000…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score26/ 100 · Low

impact 25.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 18, 2025

Updated

Oct 30, 2026

CVSS

4.7

Vendor

Linux

Product

Linux

CWE

—

Depth score

26 · Low

EPSS

0.11% · p1

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

decided 2026-01-14

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Nov 3.

0.1% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 411 days

Sep 18, 2025Published
Disclosed via CVEORG
Oct 30, 2026Record revised
Last analysed / modified upstream
Nov 3, 2026EPSS first tracked
0.1%

Linux #cve.org

Affected

Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < f6464b3c31344af4964443dbbcb4596ac9b46519
Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 115557cc226a927924f2d7d1980ccbf6e3b3bb36
Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 458c15dfbce62c35fefd9ca637b20a051309c9f1
Linux 3.8

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

f2fs: don't reset unchangable mount option in f2fs_remount()

syzbot reports a bug as below:

general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN RIP: 0010:__lock_acquire+0x69/0x2000 kernel/locking/lockdep.c:4942 Call Trace: lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5691 __raw_write_lock include/linux/rwlock_api_smp.h:209 [inline] _raw_write_lock+0x2e/0x40 kernel/locking/spinlock.c:300 __drop_extent_tree+0x3ac/0x660 fs/f2fs/extent_cache.c:1100 f2fs_drop_extent_tree+0x17/0x30 fs/f2fs/extent_cache.c:1116 f2fs_insert_range+0x2d5/0x3c0 fs/f2fs/file.c:1664 f2fs_fallocate+0x4e4/0x6d0 fs/f2fs/file.c:1838 vfs_fallocate+0x54b/0x6b0 fs/open.c:324 ksys_fallocate fs/open.c:347 [inline] __do_sys_fallocate fs/open.c:355 [inline] __se_sys_fallocate fs/open.c:353 [inline] __x64_sys_fallocate+0xbd/0x100 fs/open.c:353 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The root cause is race condition as below:

since it tries to remount rw filesystem, so that do_remount won't call sb_prepare_remount_readonly to block fallocate, there may be race condition in between remount and fallocate.
in f2fs_remount(), default_options() will reset mount option to default one, and then update it based on result of parse_options(), so there is a hole which race condition can happen.

Thread A Thread B

f2fs_fill_super
parse_options
clear_opt(READ_EXTENT_CACHE)
f2fs_remount
default_options
set_opt(READ_EXTENT_CACHE) - f2fs_fallocate - f2fs_insert_range - f2fs_drop_extent_tree - __drop_extent_tree - __may_extent_tree - test_opt(READ_EXTENT_CACHE) return true - write_lock(&et->lock) access NULL pointer
parse_options
clear_opt(READ_EXTENT_CACHE)

Affected

Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < f6464b3c31344af4964443dbbcb4596ac9b46519
Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 115557cc226a927924f2d7d1980ccbf6e3b3bb36
Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 458c15dfbce62c35fefd9ca637b20a051309c9f1
Linux 3.8

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

f2fs: don't reset unchangable mount option in f2fs_remount()

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score26/ 100 · Low

impact 25.9 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

f2fs: don't reset unchangable mount option in f2fs_remount()

syzbot reports a bug as below:

The root cause is race condition as below:

since it tries to remount rw filesystem, so that do_remount won't call sb_prepare_remount_readonly to block fallocate, there may be race condition in between remount and fallocate.

in f2fs_remount(), default_options() will reset mount option to default one, and then update it based on result of parse_options(), so there is a hole which race condition can happen.

Thread A Thread B

f2fs_fill_super

parse_options

clear_opt(READ_EXTENT_CACHE)

f2fs_remount

default_options

set_opt(READ_EXTENT_CACHE) - f2fs_fallocate - f2fs_insert_range - f2fs_drop_extent_tree - __drop_extent_tree - __may_extent_tree - test_opt(READ_EXTENT_CACHE) return true - write_lock(&et->lock) access NULL pointer

parse_options

clear_opt(READ_EXTENT_CACHE)