CVE-2023-54080: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54080 is a null pointer dereference vulnerability in the Linux kernel's btrfs (B-tree filesystem) subsystem, specifically in the zoned device handling code. The flaw occurs during relocation operations when btrfs_reloc_clone_csums() finds no checksum for a corresponding region, causing btrfs_finish_ordered_zoned() to set an invalid logical address on the ordered extent. This invalid value then causes btrfs_lookup_block_group() in btrfs_zone_finish_endio() to fail to locate a block group, resulting in a null pointer dereference or assertion failure. The vulnerability was published on December 24, 2025, and affects the Linux kernel. It carries an EPSS score of 0.018% (very low), indicating minimal exploitation probability (Feedly).

The root cause is a null pointer dereference (CWE-476) in the btrfs zoned write path. During a relocation, if no checksum exists for the target region at the time btrfs_reloc_clone_csums() is called, the sum pointer in btrfs_finish_ordered_zoned() points to an invalid item. The ordered extent's logical address is then set to a garbage value, and the subsequent call to btrfs_lookup_block_group() in btrfs_zone_finish_endio() cannot find a valid block group, triggering a KASAN-detected null pointer dereference in the range [0x0000000000000088-0x000000000000008f]. The fix involves skipping the splitting and logical rewriting steps for pre-allocation writes during relocation. The bug is reproducible by running the btrfs/028 test case multiple times with a null_blk device configured with 32 MB zone size/capacity and 5 GB storage (Feedly).

Successful triggering of this vulnerability causes a kernel null pointer dereference, which can crash the affected Linux system (denial of service). The crash occurs in a kernel worker thread (kworker/u16:13) handling btrfs endio-write operations, meaning it can be triggered during normal filesystem activity on zoned block devices. There is no evidence of confidentiality or integrity impact beyond system availability loss; the vulnerability does not appear to enable privilege escalation or data exfiltration (Feedly).

The Linux kernel maintainers have issued patches addressing this vulnerability, with fixes committed to the stable kernel tree (commits c02d35d89b317994bd713ba82e160c5e7f22d9c8 and d3cfa44164688a076e8b476cafb5df87d07cfa63). SUSE has released updated kernel packages addressing this issue (referenced in SUSE advisories SUSE-2026-0281-1 and SUSE-2026-20876-1). Users running Linux systems with btrfs on zoned block devices should apply the latest kernel updates from their distribution vendor. Nessus plugin 280060 and Qualys detection 760604 are available to identify affected systems (Feedly, Tenable).