Re: [OE-core][PATCH v3 7/9] cve-exclusions: set status for CVE-2023-3397

[Paul Barker <paul@pbarker.dev>]

On Wed, 2026-08-12 at 02:28 -0500, Junjie Cao wrote:
> txEnd() in fs/jfs/jfs_txnmgr.c reads the log pointer from the superblock
> info, drops TXN_LOCK and then takes log->gclock, while lmLogClose() can
> free that log during umount.
> 
> No fix has been merged. The 2023 proposal was withdrawn by its author
> ("I think my fix method is not a good solution"), and the 2026 proposals
> for the same unmount race are unreviewed:
> 
>   https://lore.kernel.org/all/20230515095956.17898-1-zyytlz.wz@163.com/
>   https://lore.kernel.org/all/20260505123330.2822833-1-tristmd@gmail.com/
>   https://lore.kernel.org/all/20260603171620.2532527-1-jie.wang@intel.com/

The proposed patches from this year are certainly for a similar slab
use-after-free race, but I can't be sure it's exactly the same. So
please re-word this.

> 
> The txEnd() sequence is unchanged in linux-next 20260727, and the
> use-after-free was reported again in June 2026 against 7.0-rc1, with the
> free stack in lmLogClose() via jfs_umount(); syzbot still lists it open:
> 
>   https://lore.kernel.org/all/6a3eedfa.fd822575.2d6b21.e180@mx.google.com/
>   https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb

Again, may be a similar use-after-free, validating that it is exactly
the same one is time consuming.

> CONFIG_JFS_FS=n in both ktypes/standard and ktypes/preempt-rt in
> yocto-kernel-cache, and no fragment enables it.

Yes, but users may enable this, so it's not relevant to the analysis.

> 
> CC: Paul Barker <paul@pbarker.dev>
> AI-Generated: Uses Claude (claude-opus-5)
> Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
> ---
> v3:
> - correct the claim that only one fix was proposed and withdrawn:
>   further fixes were posted in 2026 but none is merged
> - add the syzbot dashboard and the June 2026 report as evidence the
>   race is still live in mainline
> 
> v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/
> 
>  meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
> index a909aef..c4a9dea 100644
> --- a/meta/recipes-kernel/linux/cve-exclusion.inc
> +++ b/meta/recipes-kernel/linux/cve-exclusion.inc
> @@ -237,3 +237,10 @@ CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17"
>  # https://www.willsroot.io/2022/12/entrybleed.html
>  CVE_STATUS[CVE-2022-4543] = "unpatched: no upstream fix, KASLR is not \
>  treated as a defence against local attackers"
> +
> +# JFS txEnd()/lmLogClose() use-after-free on unmount. No fix merged: the
> +# 2023 proposal was withdrawn, the 2026 proposals are unreviewed, and the
> +# racy code is unchanged; syzbot still reproduces it.
> +# https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb
> +CVE_STATUS[CVE-2023-3397] = "unpatched: no upstream fix merged, the \
> +affected fs/jfs txEnd()/lmLogClose() unmount race is unchanged"

Recommended wording, links and include triage date:

    # Triaged August 2026 - Originally proposed fix was withdrawn, similar
    # slab-use-after-free appears to have been re-found by syzkaller in 2026.
    # Unfixed in Debian, "needs evaluation" in Ubuntu.
    # https://lore.kernel.org/lkml/CAJedcCzmx02bfa22QezE8mu-iDsSdSy_oApT2ozCWO8O-8MJEQ@mail.gmail.com/
    # https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb
    # https://security-tracker.debian.org/tracker/CVE-2023-3397
    # https://ubuntu.com/security/CVE-2023-3397
    CVE_STATUS[CVE-2023-3397] = "unpatched: Proposed fix was withdrawn"

Best regards,

-- 
Paul Barker