CVE-2023-54107
Description
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: dropping parent refcount after pd_free_fn() is done
Some cgroup policies will access parent pd through child pd even after pd_offline_fn() is done. If pd_free_fn() for parent is called before child, then UAF can be triggered. Hence it's better to guarantee the order of pd_free_fn().
Currently refcount of parent blkg is dropped in __blkg_release(), which is before pd_free_fn() is called in blkg_free_work_fn() while blkg_free_work_fn() is called asynchronously.
This patch make sure pd_free_fn() called from removing cgroup is ordered by delaying dropping parent refcount after calling pd_free_fn() for child.
BTW, pd_free_fn() will also be called from blkcg_deactivate_policy() from deleting device, and following patches will guarantee the order.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A use-after-free in the Linux kernel's block cgroup subsystem due to improper ordering of parent refcount release before pd_free_fn() completes.
Vulnerability: CVE-2023-54107 is a use-after-free (UAF) bug in the Linux kernel's block cgroup (blk-cgroup) subsystem. The root cause is an ordering issue: the parent blkg's reference count is dropped in __blkg_release() before pd_free_fn() is called for the child blkg in `blkg_free_work_fn() is invoked asynchronously. This allows a parent policy data (policy data) to be freed while the child still holds a pointer to it, leading to UAF [1].
Exploitation requires the ability to trigger cgroup removal operations that exercise this race condition. An attacker with local access and sufficient privileges to manipulate cgroup configurations could potentially trigger the race, causing a use-after-free in kernel memory. No authentication is needed beyond local access to the system [1].
Impact: A successful exploit could allow an attacker to corrupt kernel memory, potentially leading to privilege escalation or system crash. The vulnerability is in the core block layer, which is widely used in server and desktop environments.
Mitigation: The fix is included in the Linux kernel stable kernel tree commit c7241babf0855d8a6180cd1743ff0ec34de40b4e [1]. Users should apply the latest stable kernel updates to ensure the fix is included.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
1c7241babf085Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.