CVE-2023-54153 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
ext4: turn quotas off if mount failed after enabling quotas
Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4_mark_recovery_complete() returns an error value, the error handling path does not turn off the enabled quotas, which triggers the following kmemleak:
================================================================ unreferenced object 0xffff8cf68678e7c0 (size 64): comm "mount", pid 746, jiffies 4294871231 (age 11.540s) hex dump (first 32 bytes): 00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00 ............A... c7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00 ............H... backtrace: [<00000000c561ef24>] __kmem_cache_alloc_node+0x4d4/0x880
[<00000000d4e621d7>] kmalloc_trace+0x39/0x140
[<00000000837eee74>] v2_read_file_info+0x18a/0x3a0
[<0000000088f6c877>] dquot_load_quota_sb+0x2ed/0x770
[<00000000340a4782>] dquot_load_quota_inode+0xc6/0x1c0
[<0000000089a18bd5>] ext4_enable_quotas+0x17e/0x3a0 [ext4]
[<000000003a0268fa>] __ext4_fill_super+0x3448/0x3910 [ext4]
[<00000000b0f2a8a8>] ext4_fill_super+0x13d/0x340 [ext4]
[<000000004a9489c4>] get_tree_bdev+0x1dc/0x370
[<000000006e723bf1>] ext4_get_tree+0x1d/0x30 [ext4]
[<00000000c7cb663d>] vfs_get_tree+0x31/0x160
[<00000000320e1bed>] do_new_mount+0x1d5/0x480
[<00000000c074654c>] path_mount+0x22e/0xbe0
[<0000000003e97a8e>] do_mount+0x95/0xc0
[<000000002f3d3736>] __x64_sys_mount+0xc4/0x160
[<0000000027d2140c>] do_syscall_64+0x3f/0x90
================================================================
To solve this problem, we add a "failed_mount10" tag, and call ext4_quota_off_umount() in this tag to release the enabled qoutas.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 01/03/2026
The vulnerability described in CVE-2023-54153 resides within the ext4 filesystem implementation of the Linux kernel, specifically concerning the management of disk quotas during mount operations. This issue manifests when the ext4 filesystem attempts to enable quotas but encounters a failure during the mount process, particularly after the ext4_mark_recovery_complete() function returns an error. The core problem lies in the inadequate error handling mechanism that fails to properly disable or release the quotas that were previously enabled, leading to resource leaks and potential system instability. The vulnerability is classified under CWE-457 as "Use of Uninitialized Variable" and also relates to CWE-754 as "Improper Check for Unusual or Exceptional Conditions" within the context of filesystem operations.
The technical flaw occurs in the mount path of ext4 filesystem where quota management is handled. When ext4_enable_quotas() is called to activate quota support, it sets up the necessary structures and data structures for quota tracking. However, if the subsequent ext4_mark_recovery_complete() function returns an error, indicating a failure in the recovery process, the code path does not include a mechanism to properly disable these quotas. This creates a scenario where quota structures remain in an enabled state while the filesystem mount operation has effectively failed, leading to memory leaks as evidenced by the kmemleak detection tool. The memory leak specifically involves a 64-byte structure that remains unreferenced and is traced back through the call stack involving quota loading functions, particularly dquot_load_quota_sb() and dquot_load_quota_inode() which are part of the kernel's quota subsystem.
The operational impact of this vulnerability extends beyond simple memory leaks to potentially affect system stability and resource management. When a mount operation fails while quotas are enabled, the system may experience gradual memory consumption issues as these unreferenced quota structures accumulate over time. This can lead to system performance degradation, particularly in environments where frequent mount operations occur or where filesystems are mounted with quota support. The vulnerability is particularly concerning in high-availability systems or environments where memory management is critical, as the accumulation of these leaked structures could eventually contribute to system resource exhaustion. Additionally, the presence of unreferenced memory structures can interfere with memory management subsystems and potentially create conditions that may be exploited by malicious actors.
The resolution implemented for CVE-2023-54153 involves adding a specific error handling tag called "failed_mount10" which ensures that when mount operations fail after quotas have been enabled, the ext4_quota_off_umount() function is properly called to release the quota structures. This approach follows the principle of defensive programming and proper resource cleanup, ensuring that all allocated resources are appropriately deallocated regardless of the success or failure of the mount operation. The fix directly addresses the root cause by implementing a rollback mechanism that maintains consistency between the quota state and the actual filesystem mount state. This solution aligns with ATT&CK technique T1490 as it addresses system resource manipulation and memory management issues, and follows the security principle of least privilege by ensuring that filesystem resources are properly managed and released. The implementation also demonstrates proper error handling patterns that prevent resource leaks and maintain system integrity during exceptional conditions, which is consistent with the Linux kernel security best practices and the broader security engineering principles outlined in various security frameworks.