Executive brief
A race condition exists in the Linux kernel's block I/O quality-of-service (rq_qos) subsystem that can occur when cgroup policies are being enabled or disabled while disk management operations are in progress. An attacker with local access to the system could exploit this to cause kernel crashes or information leaks, potentially disrupting system availability or accessing sensitive kernel memory.
Technical details
The vulnerability is a race condition and use-after-free issue in the block/rq_qos subsystem. The root cause stems from the relocation of rq_qos_exit() from disk_release() to del_gendisk() in commit 50e34d78815e, which creates three race conditions: (1) concurrent writes to q->rq_qos when rq_qos_add() races with del_gendisk(), (2) null-pointer dereference when rq_qos_exit() is called between rq_qos_add() and blkcg_activate_policy(), and (3) memory leaks when rq_qos_exit() races with blkg_conf_open_bdev(). The fix introduces a new disk-level mutex 'rq_qos_mutex' to synchronize these operations. The vulnerability is triggered through local cgroup filesystem operations and requires no elevated privileges, making it reachable to unprivileged users on multi-user systems.
Affected products
- Linux Linux kernel affected versions with commit 50e34d78815e applied
Timeline
- 2025-12-09: disclosed: CVE-2023-53823 published to NVD