CVE-2023-54117 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
s390/dcssblk: fix kernel crash with list_add corruption
Commit fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk association") introduced new logic for gendisk association, requiring drivers to explicitly call dax_add_host() and dax_remove_host().
For dcssblk driver, some dax_remove_host() calls were missing, e.g. in device remove path. The commit also broke error handling for out_dax case in device add path, resulting in an extra put_device() w/o the previous get_device() in that case.
This lead to stale xarray entries after device add / remove cycles. In the case when a previously used struct gendisk pointer (xarray index) would be used again, because blk_alloc_disk() happened to return such a pointer, the xa_insert() in dax_add_host() would fail and go to out_dax, doing the extra put_device() in the error path. In combination with an already flawed error handling in dcssblk (device_register() cleanup), which needs to be addressed in a separate patch, this resulted in a missing device_del() / klist_del(), and eventually in the kernel crash with list_add corruption on a subsequent device_add() / klist_add().
Fix this by adding the missing dax_remove_host() calls, and also move the put_device() in the error path to restore the previous logic.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/03/2026
The vulnerability CVE-2023-54117 represents a critical kernel panic condition affecting the Linux s390 architecture, specifically within the dcssblk driver subsystem. This issue stems from improper device management during disk allocation and deallocation cycles, creating a scenario where kernel memory structures become corrupted through list manipulation errors. The root cause lies in the modification of DAX (Direct Access) device handling logic introduced in commit fb08a1908cb1, which fundamentally altered how gendisk associations are managed between DAX devices and generic block devices. The dcssblk driver, which handles IBM System/390 channel subsystem block devices, failed to properly implement the new required API calls, specifically missing critical dax_remove_host() invocations during device removal operations.
The technical flaw manifests through a cascade of improper reference counting and memory management operations that ultimately result in xarray corruption within the kernel's device management subsystem. When device removal occurs, the absence of proper dax_remove_host() calls leaves stale entries in the xarray data structure, which maintains associations between DAX devices and generic block disks. This corruption becomes particularly problematic when the kernel reuses previously allocated struct gendisk pointers, as the xa_insert() operation in dax_add_host() fails due to duplicate entries. The flawed error handling logic in the device addition path then triggers an extra put_device() operation without the corresponding get_device() call, creating an imbalance in the device reference counter. This fundamental reference counting error, combined with the xarray corruption, creates a state where device cleanup operations become incomplete, specifically missing device_del() and klist_del() calls that are essential for proper kernel object lifecycle management.
The operational impact of this vulnerability is severe, as it can lead to immediate kernel crashes through list corruption errors during subsequent device addition operations. The kernel crash occurs when the system attempts to perform list_add operations on already corrupted data structures, specifically during klist_add() calls that expect consistent device management state. This vulnerability affects systems running Linux kernels that include the problematic commit, particularly those utilizing IBM System/390 architecture with channel subsystem block devices. The instability can manifest during normal system operations when device hot-plugging or removal occurs, potentially leading to complete system crashes and data loss. The issue is particularly dangerous in production environments where device management operations are frequent, as it can cause unpredictable system behavior and require complete system restarts to recover from the corrupted state.
Mitigation strategies should focus on applying the official kernel patch that addresses both the missing dax_remove_host() calls and restores proper error handling logic in the device addition path. System administrators should prioritize updating their kernel versions to include the fix, particularly in environments running IBM z/VM or other s390-based systems where dcssblk drivers are actively used. The patch implementation requires careful monitoring during system updates to ensure that all device management paths properly handle the new DAX device association requirements. Additionally, organizations should implement comprehensive testing procedures to validate device management operations, particularly around hot-plugging scenarios and device lifecycle events. The fix aligns with CWE-459 standards for incomplete cleanup operations and addresses ATT&CK techniques related to privilege escalation through kernel exploitation, as this vulnerability could potentially be leveraged to gain elevated system privileges through controlled kernel crashes. Organizations should also consider implementing monitoring solutions that can detect early signs of device management corruption, as the vulnerability can cause subtle behavioral changes before resulting in complete system crashes.