CVE-2023-54317: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54317 is a Linux kernel vulnerability in the dm-flakey device mapper target that causes corruption of the kernel's zero page (ZERO_PAGE(0)) when the "corrupt bio writes" option is enabled. When __blkdev_issue_zero_pages submits a write bio with a bio vector pointing to the zero page, dm-flakey incorrectly corrupts its contents, leading to crashes in userspace programs that rely on glibc's assumption that mmap-returned memory is zeroed (used in calloc implementations). The vulnerability was published on December 30, 2025, and affects multiple stable Linux kernel branches. It carries an estimated CVSS severity of Medium with an EPSS score of 0.000240 (Feedly, EUVD).

The root cause is an improper check in the dm-flakey kernel module: when the "corrupt bio writes" fault injection option is active, the module modifies page data in bio vectors without first verifying whether the target page is the shared, read-only kernel zero page (ZERO_PAGE(0)). This falls under CWE-787 (Out-of-bounds Write) or more precisely improper write to a shared kernel resource. The fix adds a guard condition — if (page == ZERO_PAGE(0)) skip corruption — to prevent modification of this globally shared page. The vulnerability is triggered locally when dm-flakey is configured with corrupt bio writes and a zeroing operation (e.g., blkdev_issue_zeroout) is performed on the mapped device (Feedly, EUVD).

Exploitation of this vulnerability results in corruption of the kernel's zero page, which is a globally shared, read-only memory page. Because glibc's calloc implementation relies on mmap-returned pages being zeroed, corruption of ZERO_PAGE(0) causes userspace programs to receive non-zeroed memory from calloc, leading to unpredictable behavior, data corruption, and crashes of arbitrary userspace processes on the affected system. The primary impact is availability (system instability and process crashes) and integrity (memory content corruption), with no direct confidentiality impact reported (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Patched versions include 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. Administrators should update to a patched kernel version for their respective stable branch. As a workaround, avoid enabling the "corrupt bio writes" option in dm-flakey configurations on production systems, as this option is intended solely for fault injection testing (EUVD, Feedly).