# CVE-2023-54117: s390/dcssblk: fix kernel crash with list_add corruption

> A local attacker with high privileges can trigger a kernel crash via list corruption in the s390 dcssblk driver due to missing cleanup calls.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Dec 2025
- **Updated:** 11 May 2026
- **Also known as:** BELL-CVE-2023-54117, DEBIAN-CVE-2023-54117, GHSA-gmqv-2fjq-fw5c, UBUNTU-CVE-2023-54117

## What is CVE-2023-54117?

CVE-2023-54117 is a memory corruption vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

s390/dcssblk: fix kernel crash with list_add corruption

Commit fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk
association") introduced new logic for gendisk association, requiring
drivers to explicitly call dax_add_host() and dax_remove_host().

For dcssblk driver, some dax_remove_host() calls were missing, e.g. in
device remove path. The commit also broke error handling for out_dax case
in device add path, resulting in an extra put_device() w/o the previous
get_device() in that case.

This lead to stale xarray entries after device add / remove cycles. In the
case when a previously used struct gendisk pointer (xarray index) would be
used again, because blk_alloc_disk() happened to return such a pointer, the
xa_insert() in dax_add_host() would fail and go to out_dax, doing the extra
put_device() in the error path. In combination with an already flawed error
handling in dcssblk (device_register() cleanup), which needs to be
addressed in a separate patch, this resulted in a missing device_del() /
klist_del(), and eventually in the kernel crash with list_add corruption on
a subsequent device_add() / klist_add().

Fix this by adding the missing dax_remove_host() calls, and also move the
put_device() in the error path to restore the previous logic.

## Which versions are affected by CVE-2023-54117?


## How do I fix CVE-2023-54117?

Apply the vendor's patch.

## Is CVE-2023-54117 being exploited?

There is no known exploitation of CVE-2023-54117 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2023-54117 and fix it if it is affected.

What it is: CVE-2023-54117 is a memory corruption vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2023-54117 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2023-54117/ (Markdown: https://insights.sbomify.com/CVE-2023-54117/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2023-54117
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-54117
- OSV: https://osv.dev/vulnerability/CVE-2023-54117

---
From sbomify Insights: https://insights.sbomify.com/CVE-2023-54117/
Summaries are generated and may contain mistakes; the official description above is the record.