CVE-2023-54187: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-54187 is a filesystem corruption vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation, triggered when moving a directory. The flaw mirrors a previously identified issue in ext4 (fixed by commit 0813299c586b, "ext4: Fix possible corruption when moving a directory") and was revealed by the xfstests/generic/707 test case. It was published on December 30, 2025, and affects the Linux kernel across multiple stable branches. The CVSS estimate is Medium severity, with an EPSS score of approximately 0.024% (Feedly, EUVD).

The vulnerability is rooted in improper handling of directory rename/move operations within the F2FS filesystem driver, classified under filesystem data integrity issues (related to CWE-362 or improper state management during concurrent operations). When a directory is moved (renamed), F2FS fails to correctly handle certain internal state transitions, potentially leading to on-disk corruption — the same class of bug previously fixed in ext4. The issue was surfaced by the xfstests generic/707 test, which specifically exercises directory rename edge cases. Patches were applied across multiple stable kernel branches, with fixes committed to stable trees targeting kernel versions 5.4.x, 5.10.x, 5.15.x, 6.1.x, 6.2.x, 6.3.x, and 6.4+ (EUVD, Kernel Patch 1).

Successful triggering of this vulnerability can result in filesystem corruption on F2FS-formatted volumes, potentially causing data loss, system crashes (kernel panics), or an unbootable system. The impact is primarily on availability and data integrity, with no direct confidentiality impact reported. Systems using F2FS — commonly found on embedded Linux devices, Android-based systems, and SSDs/flash storage — are at risk if directory move operations are performed on affected kernel versions (Feedly, EUVD).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-54187. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. Exploitation would require local access to a system with an F2FS-mounted filesystem and the ability to perform directory move operations (Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Fixed versions include kernel 5.4.243, 5.10.180, 5.15.112, 6.1.29, 6.2.16, 6.3.3, and 6.4+. Administrators should update to a patched kernel version as soon as possible. As a temporary workaround, avoiding the use of F2FS filesystems or refraining from directory move operations on F2FS volumes can reduce exposure until patching is feasible (EUVD, Red Hat Bugzilla).