CVE-2023-53526 jbd2: check 'jh->b_transaction' before removing it from checkpoint
A race condition in the Linux kernel's jbd2 filesystem code can lead to ext4 image corruption and data loss during specific checkpoint operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53526?
CVE-2023-53526 is a high-severity vulnerability in Linux kernel, published on 1 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
jbd2: check 'jh->b_transaction' before removing it from checkpoint
Following process will corrupt ext4 image: Step 1: jbd2_journal_commit_transaction __jbd2_journal_insert_checkpoint(jh, commit_transaction) // Put jh into trans1->t_checkpoint_list journal->j_checkpoint_transactions = commit_transaction // Put trans1 into journal->j_checkpoint_transactions
Step 2: do_get_write_access test_clear_buffer_dirty(bh) // clear buffer dirty，set jbd dirty __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2
Step 3: drop_cache journal_shrink_one_cp_list jbd2_journal_try_remove_checkpoint if (!trylock_buffer(bh)) // lock bh, true if (buffer_dirty(bh)) // buffer is not dirty __jbd2_journal_remove_checkpoint(jh) // remove jh from trans1->t_checkpoint_list
Step 4: jbd2_log_do_checkpoint trans1 = journal->j_checkpoint_transactions // jh is not in trans1->t_checkpoint_list jbd2_cleanup_journal_tail(journal) // trans1 is done
Step 5: Power cut, trans2 is not committed, jh is lost in next mounting.
Fix it by checking 'jh->b_transaction' before remove it from checkpoint.
Which versions are affected by CVE-2023-53526?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53526?
Apply the vendor's patch.
Is CVE-2023-53526 being exploited?
There is no known exploitation of CVE-2023-53526 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53526, DEBIAN-CVE-2023-53526, GHSA-rhfj-r57g-8474, UBUNTU-CVE-2023-53526.