CVE-2023-54135

A low impact out-of-bounds access was found in the Linux kernel's maple tree implementation (lib/maple_tree.c). In mas_wr_end_piv(), the write offset end was used as an index into the pivot array without first checking its bounds, which can cause an out-of-bounds access on the pivot array when a write extends to the last slot in a node; in that case the node maximum should be used as the end pivot. Red Hat rated this flaw Low impact (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because it requires local access and the expected impact is limited to kernel availability, whereas the upstream CVE.org record assigns a higher score (7.8) by assuming confidentiality and integrity impacts that Red Hat's assessment does not support. Upstream further noted that no current callers reach the problematic path; the issue only arises for new users of the maple tree or when the code is backported to earlier kernels, which limits practical exposure. The vulnerable code is not present in Red Hat Enterprise Linux 6, 7, 8, and 10 or in Red Hat In-Vehicle OS, so those products are not affected; only the Red Hat Enterprise Linux 9 kernel and kernel-rt contain the vulnerable code. The fix for the affected Red Hat Enterprise Linux 9 streams is deferred given the low practical impact of this flaw, leaving a residual risk that a local user could trigger the out-of-bounds access in the maple tree code and crash the kernel (denial of service) if a code path exercising the flawed bounds handling is reached.