# CVE-2023-53537: linux: In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to avoid use-after-free for cached IPU...

CVE-2023-53537 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-53537, released October 4, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-53537
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 4, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to avoid use-after-free for cached IPU bio  xfstest generic/019 reports a bug:  kernel BUG at mm/filemap.c:1619! RIP: 0010:folio_end_writeback+0x8a/0x90 Call Trace:  end_page_writeback+0x1c/0x60  f2fs_write_end_io+0x199/0x420  bio_endio+0x104/0x180  submit_bio_noacct+0xa5/0x510  submit_bio+0x48/0x80  f2fs_submit_write_bio+0x35/0x300  f2fs_submit_merged_ipu_write+0x2a0/0x2b0  f2fs_write_single_data_page+0x838/0x8b0  f2fs_write_cache_pages+0x379/0xa30  f2fs_write_data_pages+0x30c/0x340  do_writepages+0xd8/0x1b0  __writeback_single_inode+0x44/0x370  writeback_sb_inodes+0x233/0x4d0  __writeback_inodes_wb+0x56/0xf0  wb_writeback+0x1dd/0x2d0  wb_workfn+0x367/0x4a0  process_one_work+0x21d/0x430  worker_thread+0x4e/0x3c0  kthread+0x103/0x130  ret_from_fork+0x2c/0x50  The root cause is: after cp_error is set, f2fs_submit_merged_ipu_write() in f2fs_write_single_data_page() tries to flush IPU bio in cache, however f2fs_submit_merged_ipu_write() missed to check validity of @bio parameter, result in submitting random cached bio which belong to other IO context, then it will cause use-after-free issue, fix it by adding additional validity check.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.37-1 | [DEBIAN-CVE-2023-53537](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53537.md) | Oct 4, 2025 |
| Linux | linux Debian 13.5 (trixie) | 6.3.7-1 | [DEBIAN-CVE-2023-53537](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53537.md) | Oct 4, 2025 |
| Linux | linux Debian 14 | 6.3.7-1 | [DEBIAN-CVE-2023-53537](https://patchblox.com/security/data/fix/linux/debian-cve-2023-53537.md) | Oct 4, 2025 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.