CVE-2023-54107 blk-cgroup: dropping parent refcount after pd_free_fn() is done
A use-after-free vulnerability in the Linux kernel block cgroup subsystem allows attackers to potentially execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-54107?
CVE-2023-54107 is a high-severity use after free vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: dropping parent refcount after pd_free_fn() is done
Some cgroup policies will access parent pd through child pd even after pd_offline_fn() is done. If pd_free_fn() for parent is called before child, then UAF can be triggered. Hence it's better to guarantee the order of pd_free_fn().
Currently refcount of parent blkg is dropped in __blkg_release(), which is before pd_free_fn() is called in blkg_free_work_fn() while blkg_free_work_fn() is called asynchronously.
This patch make sure pd_free_fn() called from removing cgroup is ordered by delaying dropping parent refcount after calling pd_free_fn() for child.
BTW, pd_free_fn() will also be called from blkcg_deactivate_policy() from deleting device, and following patches will guarantee the order.
Which versions are affected by CVE-2023-54107?
How do I fix CVE-2023-54107?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-54107 being exploited?
There is no known exploitation of CVE-2023-54107 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-54107, DEBIAN-CVE-2023-54107, GHSA-4mrm-9mrj-crwx, ROOT-OS-DEBIAN-12-CVE-2023-54107, ROOT-OS-UBUNTU-2204-CVE-2023-54107, UBUNTU-CVE-2023-54107.