7.8

CVE-2023-54285: iomap: Fix possible overflow condition in iomap_write_delalloc_scan

Modified
AliasesUBUNTU-CVE-2023-54285DEBIAN-CVE-2023-54285
Published 30-12-2025Last modified 15-10-2026

Vulnerability summary

CVE-2023-54285 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.5% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 8
DLA-4476-1DSA-6127-1SUSE-SU-2026:0278-1SUSE-SU-2026:0281-1SUSE-SU-2026:0293-1SUSE-SU-2026:0315-1

Timeline

  1. 30-12-2025
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: iomap: Fix possible overflow condition in iomap_write_delalloc_scan folio_next_index() returns an unsigned long value which left shifted by PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead use folio_pos(folio) + folio_size(folio), which does this correctly.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

8%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.18% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu85 products
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
  • linux-aws-5.13All versions (No fix recorded)
  • linux-aws-5.19All versions (No fix recorded)
Linux2 products
  • linux≥ 38be53c3fd7f4f4bd5de319a323d72f9f6beb16d, < 0c6cf409093f307ee05114f834516730c0da5b21 | ≥ f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78, < 5c281b0c5d18c8eeb1cfd5023f4adb153e6d1240 | ≥ f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78, < eee2d2e6ea5550118170dbd5bb1316ceb38455fb | ≥ 6.1.92, < 6.1.162 | 6.2
  • linux_kernel≥ 6.1.92, < 6.1.162 | ≥ 6.2, < 6.5.5
Debian1 product
  • linux< 6.1.162-1 | < 6.5.6-1

3 vendors · 88 products

References

7 links