CVE-2023-54293
Description
In the Linux kernel, the following vulnerability has been resolved:
bcache: fixup btree_cache_wait list damage
We get a kernel crash about "list_add corruption. next->prev should be prev (ffff9c801bc01210), but was ffff9c77b688237c. (next=ffffae586d8afe68)."
crash> struct list_head 0xffff9c801bc01210 struct list_head { next = 0xffffae586d8afe68, prev = 0xffffae586d8afe68 } crash> struct list_head 0xffff9c77b688237c struct list_head { next = 0x0, prev = 0x0 } crash> struct list_head 0xffffae586d8afe68 struct list_head struct: invalid kernel virtual address: ffffae586d8afe68 type: "gdb_readmem_callback" Cannot access memory at address 0xffffae586d8afe68
[230469.019492] Call Trace: [230469.032041] prepare_to_wait+0x8a/0xb0 [230469.044363] ? bch_btree_keys_free+0x6c/0xc0 [escache] [230469.056533] mca_cannibalize_lock+0x72/0x90 [escache] [230469.068788] mca_alloc+0x2ae/0x450 [escache] [230469.080790] bch_btree_node_get+0x136/0x2d0 [escache] [230469.092681] bch_btree_check_thread+0x1e1/0x260 [escache] [230469.104382] ? finish_wait+0x80/0x80 [230469.115884] ? bch_btree_check_recurse+0x1a0/0x1a0 [escache] [230469.127259] kthread+0x112/0x130 [230469.138448] ? kthread_flush_work_fn+0x10/0x10 [230469.149477] ret_from_fork+0x35/0x40
bch_btree_check_thread() and bch_dirty_init_thread() may call mca_cannibalize() to cannibalize other cached btree nodes. Only one thread can do it at a time, so the op of other threads will be added to the btree_cache_wait list.
We must call finish_wait() to remove op from btree_cache_wait before free it's memory address. Otherwise, the list will be damaged. Also should call bch_cannibalize_unlock() to release the btree_cache_alloc_lock and wake_up other waiters.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A use-after-free in bcache's btree_cache_wait list can cause list corruption and kernel crash during concurrent btree node cannibalization.
Vulnerability
CVE-2023-54293 is a use-after-free vulnerability in the Linux kernel's bcache subsystem. The root cause is a missing finish_wait() call when a thread exits the mca_cannibalize path after being added to the btree_cache_wait list. When mca_cannibalize_lock() is called, threads that cannot acquire the lock are added to this wait queue. If the thread's memory is freed without properly removing it from the list, subsequent list operations corrupt the linked list, leading to a kernel crash [1].
Exploitation
An attacker would need to trigger concurrent access to bcache devices, triggering bch_btree_check_thread() or bch_dirty_init_thread() to call mca_cannibalize(). The race condition occurs when multiple threads compete for the btree_cache_alloc_lock. Only one thread can hold the lock at a time; others are queued on btree_cache_wait. If a queued thread is freed without calling `finish_wait(), the list pointers become invalid [2].
Impact
Successful exploitation results in list corruption, leading to a kernel panic (denial of service). The crash trace shows invalid memory access when the kernel tries to traverse the corrupted list. No privilege escalation is described, but the system becomes unavailable.
Mitigation
The fix was committed to the Linux kernel stable tree. The patch adds the missing finish_wait() call before freeing the memory, and ensures bch_cannibalize_unlock() is called to release the lock and wake other waiters [1][2]. Users should update to a kernel version containing the fix.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
5bcb295778afdcbdd5b3322f725ec4779d0fb2882a4c4f0c9f0854489fc07Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- git.kernel.org/stable/c/25ec4779d0fb3ed9cac1e4d9e0e4261b4a12f6ednvd
- git.kernel.org/stable/c/2882a4c4f0c90e99f37dbd8db369b9982fd613e7nvd
- git.kernel.org/stable/c/bcb295778afda4f2feb0d3c0289a53fd43d5a3a6nvd
- git.kernel.org/stable/c/cbdd5b3322f7bbe6454c97cac994757f1192c07bnvd
- git.kernel.org/stable/c/f0854489fc07d2456f7cc71a63f4faf9c716ffbenvd
News mentions
0No linked articles in our index yet.