CVE-2023-54192: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-54192 is a null pointer dereference vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) subsystem, specifically within the __replace_atomic_write_block function's tracepoint handling. The flaw causes a kernel panic when old_addr is NULL during an atomic write commit operation. It was published on December 30, 2025, and affects Linux kernel versions prior to the patched releases 6.1.29, 6.2.16, 6.3.3, and 6.4. No CVSS score has been assigned at this time, and the EPSS score is 0.000230 (Feedly, ENISA EUVD).

The root cause is a missing NULL pointer check (CWE-476) in the F2FS kernel module's __replace_atomic_write_block function, which is invoked via a tracepoint during f2fs_commit_atomic_write. When old_addr is NULL — a valid state under certain conditions — the tracepoint dereferences it unconditionally, triggering a kernel NULL pointer dereference at address 0x0000000000000000. The call chain leading to the panic is: f2fs_commit_atomic_write → __f2fs_ioctl → __x64_sys_ioctl → do_syscall_64. The fix adds a NULL guard before the tracepoint dereference. The issue was originally tracked in the Linux kernel bugzilla at bug #217266 (Feedly).

Successful triggering of this vulnerability causes a kernel panic (BUG: kernel NULL pointer dereference), resulting in a system crash and denial of service. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Any local user with the ability to invoke the F2FS_IOC_COMMIT_ATOMIC_WRITE ioctl on an F2FS-mounted filesystem can trigger the crash (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution for this vulnerability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.000230, indicating a very low probability of exploitation in the near term. Detection coverage exists via Nessus plugin 281732 (Feedly, Tenable).

The Linux kernel project has released patches addressing this vulnerability in the following stable versions: 6.1.29, 6.2.16, 6.3.3, and 6.4. The fix is available via the upstream stable kernel commits. Administrators should update to a patched kernel version. As a workaround, restricting local user access to F2FS-mounted filesystems or disabling F2FS support can reduce exposure until patching is feasible (Feedly, ENISA EUVD).