CVE-2023-54032 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race when deleting quota root from the dirty cow roots list
When disabling quotas we are deleting the quota root from the list fs_info->dirty_cowonly_roots without taking the lock that protects it, which is struct btrfs_fs_info::trans_lock. This unsynchronized list manipulation may cause chaos if there's another concurrent manipulation of this list, such as when adding a root to it with ctree.c:add_root_to_dirty_list().
This can result in all sorts of weird failures caused by a race, such as the following crash:
[337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI
[337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1
[337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]
[337571.279928] Code: 85 38 06 00 (...)
[337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206
[337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000
[337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070
[337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b
[337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600
[337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48
[337571.281723] FS: 00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000
[337571.281950] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0
[337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[337571.282874] Call Trace:
[337571.283101] <TASK>
[337571.283327] ? __die_body+0x1b/0x60
[337571.283570] ? die_addr+0x39/0x60
[337571.283796] ? exc_general_protection+0x22e/0x430
[337571.284022] ? asm_exc_general_protection+0x22/0x30
[337571.284251] ? commit_cowonly_roots+0x11f/0x250 [btrfs]
[337571.284531] btrfs_commit_transaction+0x42e/0xf90 [btrfs]
[337571.284803] ? _raw_spin_unlock+0x15/0x30
[337571.285031] ? release_extent_buffer+0x103/0x130 [btrfs]
[337571.285305] reset_balance_state+0x152/0x1b0 [btrfs]
[337571.285578] btrfs_balance+0xa50/0x11e0 [btrfs]
[337571.285864] ? __kmem_cache_alloc_node+0x14a/0x410
[337571.286086] btrfs_ioctl+0x249a/0x3320 [btrfs]
[337571.286358] ? mod_objcg_state+0xd2/0x360
[337571.286577] ? refill_obj_stock+0xb0/0x160
[337571.286798] ? seq_release+0x25/0x30
[337571.287016] ? __rseq_handle_notify_resume+0x3ba/0x4b0
[337571.287235] ? percpu_counter_add_batch+0x2e/0xa0
[337571.287455] ? __x64_sys_ioctl+0x88/0xc0
[337571.287675] __x64_sys_ioctl+0x88/0xc0
[337571.287901] do_syscall_64+0x38/0x90
[337571.288126] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[337571.288352] RIP: 0033:0x7f478aaffe9b
So fix this by locking struct btrfs_fs_info::trans_lock before deleting the quota root from that list.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/26/2025
The vulnerability CVE-2023-54032 resides within the Linux kernel's btrfs file system implementation and represents a classic race condition affecting concurrent list manipulation operations. This flaw manifests when disabling quotas within the btrfs file system, specifically during the removal of quota roots from the fs_info->dirty_cowonly_roots list. The core issue stems from an absence of proper synchronization mechanisms, as the code fails to acquire the struct btrfs_fs_info::trans_lock before performing list modifications. This unsynchronized access creates a window where concurrent operations can interfere with each other, leading to unpredictable behavior and system instability.
The technical nature of this vulnerability aligns with CWE-362, which categorizes concurrent execution using locks as a weakness. The flaw occurs in the commit_cowonly_roots function where the list manipulation is performed without proper locking, creating a scenario where multiple threads or processes can simultaneously access and modify the same data structure. The crash trace reveals a general protection fault occurring at the commit_cowonly_roots function, indicating memory corruption or invalid memory access patterns that result from the race condition. This type of concurrency issue is particularly dangerous in storage systems where data integrity and consistency are paramount.
The operational impact of this vulnerability extends beyond simple system crashes to potentially compromise data integrity and availability within btrfs file systems. When concurrent quota management operations occur, the race condition can lead to memory corruption, invalid pointer dereferences, and ultimately system panics. The vulnerability affects systems running kernel versions that include the affected btrfs implementation, particularly those actively managing quotas or performing concurrent file system operations. Attackers could potentially exploit this race condition to cause denial of service attacks or, in more sophisticated scenarios, to manipulate the file system state in ways that could lead to data corruption or unauthorized access patterns.
Mitigation strategies for CVE-2023-54032 involve applying the kernel patch that introduces proper locking mechanisms around the list manipulation operations. The fix requires acquiring the struct btrfs_fs_info::trans_lock before deleting quota roots from the dirty_cowonly_roots list, ensuring that only one thread can modify the list at any given time. System administrators should prioritize updating their kernel versions to include this patch, particularly in production environments where btrfs file systems are actively used. Additionally, monitoring systems should be implemented to detect unusual patterns in quota management operations that might indicate race condition exploitation attempts. Organizations using btrfs file systems should also consider implementing redundancy measures and regular data backups to protect against potential data corruption scenarios. This vulnerability demonstrates the critical importance of proper synchronization in concurrent programming environments and aligns with ATT&CK technique T1499.001, which covers File System Wipe, as the race condition could potentially lead to file system corruption that might require complete reinstallation of the file system.