CVE-2023-54088 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: hold queue_lock when removing blkg->q_node
When blkg is removed from q->blkg_list from blkg_free_workfn(), queue_lock has to be held, otherwise, all kinds of bugs(list corruption, hard lockup, ..) can be triggered from blkg_destroy_all().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 01/02/2026
The vulnerability identified as CVE-2023-54088 represents a critical race condition within the Linux kernel's block cgroup subsystem that can lead to system instability and potential denial of service conditions. This flaw exists in the blk-cgroup implementation which manages block I/O control groups for process isolation and resource management. The issue manifests when the kernel attempts to remove block group nodes from the queue's block group list during the cleanup process, specifically within the blkg_free_workfn() function.
The technical root cause of this vulnerability stems from improper locking mechanisms during the removal of block group entries from the queue's block group list. When blkg_free_workfn() executes the removal operation from q->blkg_list, it fails to acquire the necessary queue_lock protection that should be held during this critical section. This omission creates a window where concurrent operations can interfere with the list manipulation, leading to data structure corruption and system instability. The missing lock acquisition allows for scenarios where multiple threads might simultaneously access and modify the same list structure without proper synchronization, creating conditions that can result in memory corruption or deadlocks.
The operational impact of this vulnerability extends beyond simple system instability to potentially enable malicious actors to trigger system crashes or create persistent denial of service conditions. When the blkg_destroy_all() function attempts to process the corrupted list structure, it can encounter list corruption that leads to hard lockups, system hangs, or even kernel panics. This vulnerability affects systems that utilize block cgroup functionality for I/O resource management, which is common in virtualized environments, containerized applications, and systems with complex I/O scheduling requirements. The race condition can be triggered through normal system operations involving I/O group management, making it particularly dangerous as it may not require special privileges to exploit.
This vulnerability maps directly to CWE-362, which describes a race condition in concurrent programming where two or more threads can access shared data simultaneously, and at least one thread modifies the data, leading to unpredictable behavior. The issue also aligns with ATT&CK technique T1499.001, which involves network denial of service attacks through system resource exhaustion or corruption. The flaw demonstrates poor adherence to kernel locking best practices and represents a fundamental failure in maintaining data structure integrity during concurrent access scenarios. System administrators should prioritize patching this vulnerability as it can be exploited to cause system-wide instability, particularly in environments where block I/O cgroup management is actively utilized.
The mitigation strategy for CVE-2023-54088 involves applying the kernel patch that ensures queue_lock is properly acquired before removing blkg entries from the q->blkg_list. This fix requires modifications to the blkg_free_workfn() function to include the necessary locking mechanism before list manipulation operations. Organizations should implement immediate patching procedures, particularly in production environments where block cgroup functionality is active, as the vulnerability can be exploited to cause system-wide instability. Additionally, monitoring for system hangs or unusual I/O behavior may serve as an indicator of exploitation attempts, though the vulnerability's nature makes detection challenging due to its timing-dependent race condition characteristics.