CVE-2023-54019 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
sched/psi: use kernfs polling functions for PSI trigger polling
Destroying psi trigger in cgroup_file_release causes UAF issues when a cgroup is removed from under a polling process. This is happening because cgroup removal causes a call to cgroup_file_release while the actual file is still alive. Destroying the trigger at this point would also destroy its waitqueue head and if there is still a polling process on that file accessing the waitqueue, it will step on the freed pointer:
do_select vfs_poll do_rmdir cgroup_rmdir kernfs_drain_open_files cgroup_file_release cgroup_pressure_release psi_trigger_destroy wake_up_pollfree(&t->event_wait) // vfs_poll is unblocked synchronize_rcu kfree(t) poll_freewait -> UAF access to the trigger's waitqueue head
Patch [1] fixed this issue for epoll() case using wake_up_pollfree(),
however the same issue exists for synchronous poll() case. The root cause of this issue is that the lifecycles of the psi trigger's waitqueue and of the file associated with the trigger are different. Fix this by using kernfs_generic_poll function when polling on cgroup-specific psi triggers. It internally uses kernfs_open_node->poll waitqueue head with its lifecycle tied to the file's lifecycle. This also renders the fix in [1] obsolete, so revert it.
[1] commit c2dbe32d5db5 ("sched/psi: Fix use-after-free in ep_remove_wait_queue()")
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 12/25/2025
The vulnerability CVE-2023-54019 represents a critical use-after-free condition in the Linux kernel's pressure stall information (PSI) subsystem, specifically affecting the scheduling and process isolation mechanisms. This issue manifests when cgroup removal operations occur concurrently with polling operations on PSI trigger files, creating a race condition that can lead to memory corruption and system instability. The problem is particularly severe because it affects the core kernel scheduling infrastructure and can potentially be exploited to escalate privileges or cause denial of service attacks.
The technical flaw stems from a mismatch in the lifecycle management of PSI trigger waitqueue heads and their associated file descriptors. When a cgroup is removed, the kernel's cgroup_file_release function is invoked, which attempts to destroy the PSI trigger and its associated waitqueue head. However, if polling processes are still active on the file descriptor, they may attempt to access the waitqueue head after it has been freed, resulting in a use-after-free scenario. The vulnerability specifically impacts synchronous poll() operations, while a previous patch had only addressed the epoll() case. This discrepancy leaves the synchronous polling path vulnerable to the same memory corruption patterns that could be exploited by malicious actors.
The operational impact of this vulnerability extends beyond simple system crashes, as it can compromise the integrity of the kernel's scheduling and resource management subsystems. Attackers could potentially exploit this condition to gain elevated privileges or cause system-wide instability through carefully crafted cgroup operations. The vulnerability affects systems running Linux kernels where PSI monitoring is enabled, particularly those utilizing cgroup-based resource management and process isolation. The issue demonstrates the complexity of managing object lifecycles in concurrent kernel environments where different subsystems must coordinate their resource management operations.
The fix implemented addresses the root cause by modifying the polling mechanism to utilize kernfs_generic_poll functions instead of the problematic direct waitqueue management. This approach ensures that the waitqueue head's lifecycle is properly tied to the file descriptor's lifecycle through the kernfs subsystem, which provides better synchronization guarantees. The solution also involves reverting a previous partial fix that only addressed epoll() operations, thereby providing a comprehensive resolution that covers all polling mechanisms. This change aligns with established kernel development practices for managing object lifecycles and preventing memory corruption in concurrent environments, demonstrating the importance of consistent resource management patterns across different kernel subsystems. The fix maintains backward compatibility while providing robust protection against the use-after-free condition that could otherwise lead to system compromise or denial of service scenarios.
This vulnerability is categorized under CWE-416 as Use After Free, and relates to the ATT&CK technique T1068 for Exploitation for Privilege Escalation. The fix demonstrates proper kernel security engineering principles by ensuring object lifecycle management aligns with the subsystem's operational requirements. The solution prevents unauthorized access to freed memory structures and maintains system stability under concurrent access patterns.