CVE-2023-54132: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54132 is a vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) subsystem, specifically in the handling of non-compact HEAD index entries with invalid clusterofs values. When a crafted EROFS image contains a non-compact HEAD index with a clusterofs value outside the valid range (0 to lclustersize-1), the kernel can trigger an out-of-bounds memory access, resulting in a kernel page fault and system crash. The vulnerability was discovered via Syzbot fuzzing and disclosed on December 24, 2025. It affects Linux kernel versions from commit 02827e179 up to the respective stable branch fixes. No CVSS score has been assigned at this time (Feedly, EUVD).

The root cause is insufficient input validation (CWE-20) in the EROFS filesystem's decompression queue worker (z_erofs_decompressqueue_work). When parsing a non-compact HEAD index, the kernel does not validate that clusterofs falls within the valid range of 0 to lclustersize-1. A crafted EROFS image with clusterofs set to an out-of-range value (e.g., 33024) causes the kernel to compute an invalid memory address during decompression, triggering a supervisor read access page fault (#PF) in kernel mode at z_erofs_decompress_queue+0xb7e/0x2b40. The vulnerability is only triggered by non-compact HEAD indexes; normal images and images using compact indexes are not affected. The issue was originally identified by Syzbot using a crafted image reported at the kernel mailing list (Feedly).

Successful exploitation requires mounting a specially crafted EROFS image, which causes a kernel panic (BUG/Oops) due to an invalid memory access in kernel mode. The primary impact is a denial of service — the affected system crashes or becomes unresponsive. There is no evidence of code execution or privilege escalation potential from this vulnerability; confidentiality and integrity impacts are not expected (Feedly, EUVD).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include: 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. Administrators should update to the appropriate patched kernel version for their distribution. As a workaround, systems that do not require EROFS support can disable or avoid mounting EROFS filesystems. Distributions such as Red Hat have also tracked this issue (Feedly, EUVD).