Executive brief
A vulnerability was identified in the Linux kernel's Distributed Lock Manager (DLM), a component used to coordinate access to shared resources in a computer cluster. An error in how the system handles internal messaging could allow a local user to trigger a system crash or potentially execute unauthorized actions. This could lead to a loss of system availability or unauthorized access to sensitive data within the cluster environment.
Technical details
A use-after-free vulnerability exists in the Linux kernel's fs/dlm component, specifically within the dlm_midcomms_commit_mhandle function. The flaw is triggered during the processing of DLM messages in softirq context, where a message handle (mhandle) may be accessed after it has been released by the RCU (Read-Copy-Update) core. A local attacker with low privileges could exploit this race condition to cause a kernel panic (denial of service) or potentially achieve arbitrary code execution in kernel mode. The issue has been addressed in stable kernel updates including versions 6.1.20 and 6.2.3.
Affected products
- Linux Linux Kernel 5.14 to 6.1.20, 6.2 to 6.2.3
Timeline
- 2023-01-12: patched: Initial patch authored by Alexander Aring
- 2025-10-07: disclosed: CVE-2023-53629 published by kernel.org