txEnd() in fs/jfs/jfs_txnmgr.c reads the log pointer from the superblock info, drops TXN_LOCK and then takes log->gclock, while lmLogClose() can free that log during umount.
The subsystem in the public CVE data is misleading: the "slub" association comes from the KASAN slab report, but the affected code is JFS. Red Hat's own title for the issue is "slab-use-after-free write in txend due to race condition". A fix adding a new mutex was posted, reviewed, and then withdrawn by its author, who wrote "I think my fix method is not a good solution": https://lore.kernel.org/all/[email protected]/ No other fix has been posted, and the sequence in txEnd() is unchanged in mainline as of linux-next 20260727. syzkaller was still reporting "KASAN: slab-use-after-free Write in txEnd" in June 2026. Ubuntu records "unfixed upstream as of 2023-09-01"; Debian lists src:linux as vulnerable in every suite: https://ubuntu.com/security/CVE-2023-3397 https://security-tracker.debian.org/tracker/CVE-2023-3397 CONFIG_JFS_FS=n in both ktypes/standard/standard.cfg and ktypes/preempt-rt/preempt-rt.cfg in yocto-kernel-cache, and no fragment there enables it; the only other occurrence is CONFIG_JFS_SECURITY in the selinux feature, which has no effect without JFS_FS. CC: Paul Barker <[email protected]> AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao <[email protected]> --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/[email protected]/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 3517318e..827a487e 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -232,3 +232,10 @@ CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17" # https://www.willsroot.io/2022/12/entrybleed.html CVE_STATUS[CVE-2022-4543] = "upstream-wontfix: no fix planned, KASLR is not \ considered a defence against local attackers" + +# JFS txEnd()/lmLogClose() use-after-free, not slub as the CVE data says. +# The only proposed fix was withdrawn by its author; the racy code is +# unchanged and syzbot still reproduces it as of June 2026. +# https://lore.kernel.org/all/[email protected]/ +CVE_STATUS[CVE-2023-3397] = "unpatched: no upstream fix, the only proposed \ +patch was withdrawn by its author and the affected fs/jfs code is unchanged" -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242633): https://lists.openembedded.org/g/openembedded-core/message/242633 Mute This Topic: https://lists.openembedded.org/mt/120574087/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
