CVE-2023-54107 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: dropping parent refcount after pd_free_fn() is done
Some cgroup policies will access parent pd through child pd even after pd_offline_fn() is done. If pd_free_fn() for parent is called before child, then UAF can be triggered. Hence it's better to guarantee the order of pd_free_fn().
Currently refcount of parent blkg is dropped in __blkg_release(), which is before pd_free_fn() is called in blkg_free_work_fn() while blkg_free_work_fn() is called asynchronously.
This patch make sure pd_free_fn() called from removing cgroup is ordered by delaying dropping parent refcount after calling pd_free_fn() for child.
BTW, pd_free_fn() will also be called from blkcg_deactivate_policy() from deleting device, and following patches will guarantee the order.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/03/2026
This vulnerability exists within the Linux kernel's block cgroup subsystem where improper ordering of reference count management operations can lead to use-after-free conditions. The issue specifically affects how the kernel handles cleanup operations when cgroup policies are removed from block devices, creating a race condition that can be exploited by malicious actors. The vulnerability is classified as a memory corruption issue that stems from the improper sequencing of reference count decrements and policy free function calls within the kernel's storage subsystem. This flaw directly impacts the integrity of kernel memory management and can potentially allow privilege escalation or system instability.
The technical flaw occurs in the blk-cgroup implementation where the kernel's block device cgroup subsystem manages reference counts for block group objects and their associated policy data structures. When a cgroup policy is removed, the kernel must properly order the execution of cleanup functions to prevent dangling pointers. Currently, the __blkg_release() function reduces the parent block group reference count before pd_free_fn() is executed in blkg_free_work_fn(), which is called asynchronously. This ordering issue means that if a child policy's pd_free_fn() is executed before the parent's pd_free_fn(), the parent policy data structure may be freed while child code is still attempting to access it through parent references, resulting in a use-after-free condition that can be exploited for arbitrary code execution.
The operational impact of this vulnerability is significant as it affects the core storage management functionality of Linux systems, potentially allowing attackers to execute arbitrary code with kernel privileges. The vulnerability can be triggered through normal cgroup operations involving block device management, making it particularly dangerous in environments where users can manipulate cgroup configurations or where block device policies are dynamically modified. This represents a critical security risk that could enable attackers to gain root access or cause system crashes, as the use-after-free condition can be leveraged to corrupt kernel memory and potentially execute malicious code within kernel space. The vulnerability affects systems running Linux kernels that implement the block cgroup functionality and can be exploited through legitimate system operations without requiring special privileges.
Mitigation strategies for this vulnerability involve applying the kernel patch that ensures proper ordering of policy free function calls by delaying the parent reference count decrement until after pd_free_fn() has been executed for child policies. The fix implements a synchronization mechanism that guarantees that all child policy cleanup operations complete before parent reference counts are reduced, preventing the race condition that leads to use-after-free conditions. System administrators should immediately update to kernel versions that include this patch, as the vulnerability can be exploited remotely through cgroup management operations. Additionally, monitoring for unusual cgroup activity and implementing proper access controls for cgroup operations can help reduce the attack surface. The solution aligns with security best practices for kernel memory management and follows established patterns for preventing use-after-free vulnerabilities as outlined in common security frameworks. This vulnerability demonstrates the importance of proper reference counting and ordering in kernel subsystems, particularly in complex hierarchical data structures like cgroups where parent-child relationships must be carefully managed to prevent memory corruption. The fix addresses the underlying issue identified in CWE-416, which specifically covers use-after-free vulnerabilities, and aligns with defensive programming principles that prevent race conditions in concurrent systems.