CVE-2023-54117 s390/dcssblk: fix kernel crash with list_add corruption
A local attacker with high privileges can trigger a kernel crash via list corruption in the s390 dcssblk driver due to missing cleanup calls.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-54117?
CVE-2023-54117 is a memory corruption vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/dcssblk: fix kernel crash with list_add corruption
Commit fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk association") introduced new logic for gendisk association, requiring drivers to explicitly call dax_add_host() and dax_remove_host().
For dcssblk driver, some dax_remove_host() calls were missing, e.g. in device remove path. The commit also broke error handling for out_dax case in device add path, resulting in an extra put_device() w/o the previous get_device() in that case.
This lead to stale xarray entries after device add / remove cycles. In the case when a previously used struct gendisk pointer (xarray index) would be used again, because blk_alloc_disk() happened to return such a pointer, the xa_insert() in dax_add_host() would fail and go to out_dax, doing the extra put_device() in the error path. In combination with an already flawed error handling in dcssblk (device_register() cleanup), which needs to be addressed in a separate patch, this resulted in a missing device_del() / klist_del(), and eventually in the kernel crash with list_add corruption on a subsequent device_add() / klist_add().
Fix this by adding the missing dax_remove_host() calls, and also move the put_device() in the error path to restore the previous logic.
Which versions are affected by CVE-2023-54117?
How do I fix CVE-2023-54117?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-54117 being exploited?
There is no known exploitation of CVE-2023-54117 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-54117, DEBIAN-CVE-2023-54117, GHSA-gmqv-2fjq-fw5c, UBUNTU-CVE-2023-54117.