Executive brief
The Linux kernel's maple_tree data structure contains a boundary-checking vulnerability in the write operation function mas_wr_end_piv(). An out-of-bounds memory access can occur when a write operation extends to the last slot in a node, potentially allowing an attacker to read or corrupt kernel memory and trigger a denial of service.
Technical details
The vulnerability is a bounds-checking error in the mas_wr_end_piv() function within lib/maple_tree.c. The original code checked whether offset_end had exceeded node_end *after* attempting to use it as an array index into the pivots array, rather than before. This allows an out-of-bounds access when a write extends to the final slot of a node. The fix reorders the bounds check to occur before the array access and uses the node maximum value as a fallback when the bounds are exceeded. The vulnerability is local to the kernel and requires the maple_tree API to be actively used, which current callers do not trigger. Patches are available in Linux kernel stable trees and mainline.
Affected products
- Linux Linux kernel affected by maple_tree implementation; patches available across stable branches 4.x through 7.x and mainline
Timeline
- 2023-05-06: disclosed: Fix authored by Peng Zhang
- 2023-06-09: patched: Merged to upstream mainline
- 2023-07-01: patched: Backported to stable kernel branches
- 2025-12-24: advisory: CVE-2023-54135 published