CVE-2023-54121: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54121 is a vulnerability in the Linux kernel's Btrfs filesystem subsystem, specifically an incorrect splitting bug in the btrfs_drop_extent_map_range() function. The flaw causes an arithmetic error when calculating the len variable after skipping a pinned extent, resulting in an invalid or overlapping extent map entry being inserted into the extent map tree. It was published on December 24, 2025, and affects the Linux kernel across multiple stable branches. The CVSS score and severity rating have not been publicly assigned at this time (Feedly, CVE.org).

The root cause is an off-by-one arithmetic error (CWE-682: Incorrect Calculation) in btrfs_drop_extent_map_range() within the Linux kernel's Btrfs extent map handling code. When skip_pinned == true and a pinned extent is encountered, the code incorrectly updates the len variable as start + len - em_end instead of the correct end - em_end, causing len to retain an inflated value. When the next non-pinned extent (e.g., [32K, 48K)) is subsequently processed and needs to be split, the split extent's start and len fields are computed using the incorrect len, resulting in split->start pointing beyond the actual extent end (e.g., 52K instead of 36K), which triggers integer underflow in split->len. This produces an invalid extent map that may overlap other entries in the tree, triggering WARN_ON() assertions observed in production environments (Feedly).

Exploitation of this vulnerability can corrupt the Btrfs extent map tree, leading to kernel warnings (WARN_ON()), potential filesystem inconsistencies, and system instability. In the worst case, the corrupted extent map could cause data integrity issues or kernel panics, impacting availability of the affected system. The vulnerability is local in nature and primarily affects systems using the Btrfs filesystem under workloads that trigger extent map range drops with pinned extents (Feedly).

The fix has been committed to multiple Linux kernel stable branches via patches available at the kernel.org stable repository (commits 9f68e21, b43a4c9, and c962098). Users should update to a patched kernel version that includes the fix for btrfs_drop_extent_map_range(). As a workaround, systems not requiring Btrfs can avoid the issue by using an alternative filesystem. Administrators should monitor kernel update channels for their distribution and apply the relevant stable kernel update as soon as it becomes available (Feedly, Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).