{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.20-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.20-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.20-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process  There are two states for ubifs writing pages: 1. Dirty, Private 2. Not Dirty, Not Private  The normal process cannot go to ubifs_releasepage() which means there exists pages being private but not dirty. Reproducer[1] shows that it could occur (which maybe related to [2]) with following process:       PA                     PB                    PC lock(page)[PA] ubifs_write_end   attach_page_private         // set Private   __set_page_dirty_nobuffers  // set Dirty unlock(page)  write_cache_pages[PA]   lock(page)   clear_page_dirty_for_io(page)\t// clear Dirty   ubifs_writepage                          do_truncation[PB] \t\t\t  truncate_setsize \t\t\t    i_size_write(inode, newsize) // newsize = 0      i_size = i_size_read(inode)\t// i_size = 0     end_index = i_size \u003e\u003e PAGE_SHIFT     if (page-\u003eindex \u003e end_index)       goto out // jump out: unlock(page)   // Private, Not Dirty  \t\t\t\t\t\tgeneric_fadvise[PC] \t\t\t\t\t\t  lock(page) \t\t\t\t\t\t  invalidate_inode_page \t\t\t\t\t\t    try_to_release_page \t\t\t\t\t\t      ubifs_releasepage \t\t\t\t\t\t        ubifs_assert(c, 0) \t\t                                        // bad assertion! \t\t\t\t\t\t  unlock(page) \t\t\t  truncate_pagecache[PB]  Then we may get following assertion failed:   UBIFS error (ubi0:0 pid 1683): ubifs_assert_failed [ubifs]:   UBIFS assert failed: 0, in fs/ubifs/file.c:1513   UBIFS warning (ubi0:0 pid 1683): ubifs_ro_mode [ubifs]:   switched to read-only mode, error -22   CPU: 2 PID: 1683 Comm: aa Not tainted 5.16.0-rc5-00184-g0bca5994cacc-dirty #308   Call Trace:     dump_stack+0x13/0x1b     ubifs_ro_mode+0x54/0x60 [ubifs]     ubifs_assert_failed+0x4b/0x80 [ubifs]     ubifs_releasepage+0x67/0x1d0 [ubifs]     try_to_release_page+0x57/0xe0     invalidate_inode_page+0xfb/0x130     __invalidate_mapping_pages+0xb9/0x280     invalidate_mapping_pagevec+0x12/0x20     generic_fadvise+0x303/0x3c0     ksys_fadvise64_64+0x4c/0xb0  [1] https://bugzilla.kernel.org/show_bug.cgi?id=215373 [2] https://linux-mtd.infradead.narkive.com/NQoBeT1u/patch-rfc-ubifs-fix-assert-failed-in-ubifs-set-page-dirty",
  "id": "DEBIAN-CVE-2023-53584",
  "modified": "2026-09-15T08:47:25.530076998Z",
  "published": "2025-10-04T16:15:54.217Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2023-53584"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2023-53584"
  ]
}