CVE-2023-54182: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54182 is a kernel panic (BUG) vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) subsystem, caused by incorrect readonly condition checking in multi-device configurations. When a multi-device F2FS image is mounted with one secondary device set as read-only, the kernel incorrectly allows a subsequent remount,rw operation, leading to a kernel BUG assertion at fs/f2fs/inline.c:258 when write operations are attempted. The vulnerability affects Linux kernel versions prior to the fixes backported into stable releases 5.15.113, 6.1.30, 6.3.4, and 6.4. It was published on December 30, 2025, with an estimated CVSS severity of Medium and an EPSS score of 0.023% (Feedly, EUVD).

The root cause is improper state validation (CWE-754: Improper Check for Unusual or Exceptional Conditions) in the F2FS filesystem's f2fs_remount() function. When an F2FS volume spans multiple block devices and one secondary device is marked read-only via blockdev --setro, the remount logic fails to check the read-only status of all constituent devices before allowing a remount,rw operation. The fix introduces a new helper function f2fs_dev_is_readonly() that iterates over all devices in a multi-device F2FS configuration and correctly enforces the read-only constraint during remount. Exploitation requires local access and the ability to mount and remount F2FS filesystems, making this a local privilege/availability issue rather than a remote attack vector (Feedly, Kernel Stable).

Successful triggering of this vulnerability causes a kernel panic (BUG assertion) in f2fs_write_inline_data at fs/f2fs/inline.c:258, resulting in a system crash and denial of service. The availability impact is the primary concern, as the kernel BUG halts the affected system; there is no evidence of confidentiality or integrity compromise beyond the crash itself. Systems using F2FS multi-device configurations (e.g., with zram or other block devices) are at risk of unexpected crashes during normal write operations following an improper remount (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-54182. The vulnerability requires local access to a system with a multi-device F2FS configuration and the ability to perform mount/remount operations, significantly limiting the attack surface. The EPSS score is approximately 0.023%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing kernel BUG at fs/f2fs/inline.c:258! followed by a call trace involving f2fs_write_inline_data, f2fs_write_single_data_page, f2fs_write_cache_pages, and writeback worker threads.
• System: Unexpected system crash or reboot following a mount -o remount,rw operation on an F2FS multi-device filesystem where one device was previously set read-only.

Apply the upstream kernel patches that introduce f2fs_dev_is_readonly() and correct the multi-device readonly check in f2fs_remount(). Fixed versions include Linux kernel stable releases 5.15.113, 6.1.30, 6.3.4, and 6.4 (Feedly, Kernel Stable). As a workaround, avoid using remount,rw on F2FS multi-device filesystems where any constituent device is set read-only, and ensure all devices in a multi-device F2FS configuration share the same read/write status before mounting.