Executive brief
The Linux kernel's block I/O cgroup (blk-cgroup) subsystem manages resource allocation for storage devices. A race condition in the blkg removal code can cause list corruption, kernel hangs, and system crashes when cgroup block groups are destroyed without proper synchronization. This affects systems using container or process-level I/O resource limits.
Technical details
A race condition exists in the blk-cgroup subsystem where the blkg->q_node list element is removed without holding the queue_lock spinlock. The vulnerable code path occurs in blkg_free_workfn() and blkg_destroy() when removing block group objects from the request queue's blkg_list. This allows concurrent list traversals in blkg_destroy_all() to corrupt the list structure, leading to use-after-free, hard lockups, and kernel panics. The vulnerability requires no special privileges or user interaction—it can be triggered by normal I/O cgroup operations. Patches ensure queue_lock is held during list removal operations.
Affected products
- Linux Linux kernel multiple versions (see upstream CVE-2023-54088)
Timeline
- 2023: disclosed