GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54135 (GCVE-0-2023-54135)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:06 – Updated: 2026-08-05 09:17
VLAI
Title
maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()
Summary
In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix potential out-of-bounds access in mas_wr_end_piv() Check the write offset end bounds before using it as the offset into the pivot array. This avoids a possible out-of-bounds access on the pivot array if the write extends to the last slot in the node, in which case the node maximum should be used as the end pivot. akpm: this doesn't affect any current callers, but new users of mapletree may encounter this problem if backported into earlier kernels, so let's fix it in -stable kernels in case of this.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa , < 4e2ad53ababeaac44d71162650984abfe783960c (git)
Affected: 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa , < dc4751bd4aba01ccfc02f91adfeee0ba4cda405c (git)
Affected: 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa , < f5fcf6555a2a4f32947d17b92b173837cc652891 (git)
Affected: 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa , < cd00dd2585c4158e81fdfac0bbcc0446afbad26d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.1.37 , ≤ 6.1.* (semver)
Unaffected: 6.3.11 , ≤ 6.3.* (semver)
Unaffected: 6.4.1 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "lib/maple_tree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4e2ad53ababeaac44d71162650984abfe783960c",
              "status": "affected",
              "version": "54a611b605901c7d5d05b6b8f5d04a6ceb0962aa",
              "versionType": "git"
            },
            {
              "lessThan": "dc4751bd4aba01ccfc02f91adfeee0ba4cda405c",
              "status": "affected",
              "version": "54a611b605901c7d5d05b6b8f5d04a6ceb0962aa",
              "versionType": "git"
            },
            {
              "lessThan": "f5fcf6555a2a4f32947d17b92b173837cc652891",
              "status": "affected",
              "version": "54a611b605901c7d5d05b6b8f5d04a6ceb0962aa",
              "versionType": "git"
            },
            {
              "lessThan": "cd00dd2585c4158e81fdfac0bbcc0446afbad26d",
              "status": "affected",
              "version": "54a611b605901c7d5d05b6b8f5d04a6ceb0962aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "lib/maple_tree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.37",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.11",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmaple_tree: fix potential out-of-bounds access in mas_wr_end_piv()\n\nCheck the write offset end bounds before using it as the offset into the\npivot array.  This avoids a possible out-of-bounds access on the pivot\narray if the write extends to the last slot in the node, in which case the\nnode maximum should be used as the end pivot.\n\nakpm: this doesn\u0027t affect any current callers, but new users of mapletree\nmay encounter this problem if backported into earlier kernels, so let\u0027s\nfix it in -stable kernels in case of this."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The maple tree write path is reached only through local syscalls \u2014 `mmap()`, `munmap()`, `mprotect()`, `mremap()`, `brk()` via `vma_iter_store*()`/`vma_iter_clear*()` \u2192 `mas_store_gfp()`/`mas_store_prealloc()` \u2192 `mas_wr_end_piv()`. The other in-tree users (btrfs send LRU cache, regcache-maple) are likewise local/driver-internal, with no remote packet-processing path.\nAC:L - The trigger is a completely full 16-slot leaf node plus a store whose range starts in an earlier slot and ends inside the final slot \u2014 a tree shape an unprivileged attacker deterministically constructs by creating thousands of non-mergeable VMAs and then unmapping a spanning range. No race and no memory layout outside the attacker\u0027s influence is involved.\nPR:L - Any unprivileged local process reaches the code with plain `mmap()`/`munmap()` calls on its own address space; there is no capability check, LSM gate, or namespace requirement anywhere along `do_vmi_align_munmap()` \u2192 `vma_iter_clear_gfp()` \u2192 `mas_wr_store_entry()`.\nUI:N - The attacking process triggers the faulty write path entirely through its own address-space syscalls; no victim action, mount, or file open is required.\nS:U - The out-of-bounds pivot read and the resulting maple-tree corruption are confined to the kernel\u0027s own memory-management structures, which are the same security authority as the compromised kernel. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The array overrun reads a live kernel pointer (`slot[0]`, a `struct vm_area_struct *`) and turns it into a range boundary, and the resulting `mas-\u003elast`/`new_end` corruption leaves stale VMA pointers and bogus ranges in the VMA tree \u2014 memory corruption that can be leveraged into an arbitrary-read primitive, and whose pivot values are indirectly observable through mmap gap placement.\nI:H - A bogus `end_piv` propagates into `mas_wr_extend_null()`, which can set `mas-\u003elast` to a kernel heap pointer value beyond the node\u0027s `mas-\u003emax`, and into `mas_wr_node_store()`\u0027s `new_end` computation, causing the store to overwrite the wrong ranges and leave stale slots \u2014 VMA-tree corruption exploitable for use-after-free and arbitrary-write primitives.\nA:H - Writing a range past the node maximum and leaving stale slots violates maple-tree invariants, producing `MT_BUG_ON`/`VM_BUG_ON` hits, oopses, or use-after-free on `vm_area_struct` during any subsequent tree walk or address-space teardown, crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:33.212Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4e2ad53ababeaac44d71162650984abfe783960c"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc4751bd4aba01ccfc02f91adfeee0ba4cda405c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5fcf6555a2a4f32947d17b92b173837cc652891"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd00dd2585c4158e81fdfac0bbcc0446afbad26d"
        }
      ],
      "title": "maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54135",
    "datePublished": "2025-12-24T13:06:51.329Z",
    "dateReserved": "2025-12-24T13:02:52.522Z",
    "dateUpdated": "2026-08-05T09:17:33.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54135",
      "date": "2026-09-15",
      "epss": "0.0016",
      "percentile": "0.05573"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54135\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:15.490\",\"lastModified\":\"2026-08-04T10:19:30.993\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmaple_tree: fix potential out-of-bounds access in mas_wr_end_piv()\\n\\nCheck the write offset end bounds before using it as the offset into the\\npivot array.  This avoids a possible out-of-bounds access on the pivot\\narray if the write extends to the last slot in the node, in which case the\\nnode maximum should be used as the end pivot.\\n\\nakpm: this doesn\u0027t affect any current callers, but new users of mapletree\\nmay encounter this problem if backported into earlier kernels, so let\u0027s\\nfix it in -stable kernels in case of this.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"lib/maple_tree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"54a611b605901c7d5d05b6b8f5d04a6ceb0962aa\",\"lessThan\":\"4e2ad53ababeaac44d71162650984abfe783960c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54a611b605901c7d5d05b6b8f5d04a6ceb0962aa\",\"lessThan\":\"dc4751bd4aba01ccfc02f91adfeee0ba4cda405c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54a611b605901c7d5d05b6b8f5d04a6ceb0962aa\",\"lessThan\":\"f5fcf6555a2a4f32947d17b92b173837cc652891\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54a611b605901c7d5d05b6b8f5d04a6ceb0962aa\",\"lessThan\":\"cd00dd2585c4158e81fdfac0bbcc0446afbad26d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"lib/maple_tree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.37\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.11\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.1\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4e2ad53ababeaac44d71162650984abfe783960c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cd00dd2585c4158e81fdfac0bbcc0446afbad26d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc4751bd4aba01ccfc02f91adfeee0ba4cda405c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f5fcf6555a2a4f32947d17b92b173837cc652891\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:53:01+00:00",
      "cve": "CVE-2023-54135",
      "id": "CVE-2023-54135",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54135.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:58:16Z",
      "cve": "CVE-2023-54135",
      "id": "CVE-2023-54135",
      "initial_release_date": "2025-12-25T00:54:49Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "423",
      "product_status:recommended": "241",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54135",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54135.json",
      "version": "32"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.