CVE-2023-54253: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54253 is a kernel bug in the Linux kernel's Btrfs filesystem subsystem, specifically in the relocate_one_page function within fs/btrfs/relocation.c. The vulnerability arises because the page extent mapping is not set after read_folio is called, triggering a kernel assertion failure (PagePrivate(page) && page->private) in fs/btrfs/subpage.c:229. It was published on December 30, 2025, and affects Linux kernel versions including those around the 6.5.0-rc3+ range. The EPSS score is approximately 0.022% (very low), and no CVSS score has been formally assigned in the available data (CVE Record).

The root cause is a missing call to set the page extent mapped state after read_folio completes in the relocate_one_page function of the Btrfs relocation code. This violates an internal assertion in btrfs_subpage_assert() (CWE-617: Reachable Assertion), which expects PagePrivate and page->private to be set before subpage operations such as btrfs_subpage_set_dirty are performed. The bug was triggered during CI testing on an ARM64 system (AArch64) running Linux 6.5.0-rc3+, causing a kernel BUG/panic. Fixes are available as patches in the stable kernel tree (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).

Successful triggering of this vulnerability causes a kernel panic (BUG) on affected Linux systems using the Btrfs filesystem with subpage support, resulting in a system crash and denial of service. The availability impact is the primary concern, as the kernel halts with an internal assertion failure. There is no evidence of confidentiality or integrity impact beyond the system crash itself, and the vulnerability does not appear to enable privilege escalation or remote code execution (CVE Record).

Apply the upstream Linux kernel patches that set the page extent mapped state after read_folio in relocate_one_page. Three stable-tree patches have been identified: commits 08daa38ca212, 9d1e020ed964, and e7f1326cc24e in the Linux stable kernel repository. Users should update to a patched kernel version that includes these fixes. As a temporary workaround, avoiding Btrfs filesystem relocation operations on affected systems may reduce exposure until a patched kernel is deployed (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).