Linux Kernel pd_free_fn reference count

Summaryinfo

A vulnerability marked as critical has been reported in Linux Kernel. The impacted element is the function pd_free_fn. This manipulation causes reference count. This vulnerability is registered as CVE-2023-54107. No exploit is available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability has been found in Linux Kernel (the affected version is unknown) and classified as critical. Affected by this vulnerability is the function pd_free_fn. The manipulation with an unknown input leads to a reference count vulnerability. The CWE definition for the vulnerability is CWE-911. The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count. As an impact it is known to affect availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: dropping parent refcount after pd_free_fn() is done Some cgroup policies will access parent pd through child pd even after pd_offline_fn() is done. If pd_free_fn() for parent is called before child, then UAF can be triggered. Hence it's better to guarantee the order of pd_free_fn(). Currently refcount of parent blkg is dropped in __blkg_release(), which is before pd_free_fn() is called in blkg_free_work_fn() while blkg_free_work_fn() is called asynchronously. This patch make sure pd_free_fn() called from removing cgroup is ordered by delaying dropping parent refcount after calling pd_free_fn() for child. BTW, pd_free_fn() will also be called from blkcg_deactivate_policy() from deleting device, and following patches will guarantee the order.

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2023-54107 since 12/24/2025. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 279823 (Linux Distros Unpatched Vulnerability : CVE-2023-54107), which helps to determine the existence of the flaw in a target environment.

Applying the patch c7241babf0855d8a6180cd1743ff0ec34de40b4e is able to eliminate this problem. The bugfix is ready for download at git.kernel.org.

The vulnerability is also documented in the databases at Tenable (279823) and CERT Bund (WID-SEC-2025-2929). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion