Executive brief
The Linux kernel's block I/O cgroup subsystem has a use-after-free vulnerability in how it manages policy data cleanup. When cgroups are removed, parent and child policy data structures can be freed out of order, allowing code to access freed memory and potentially crash the system or execute arbitrary code. This affects any Linux system managing I/O resources through cgroups.
Technical details
The vulnerability is a use-after-free (UAF) in the block cgroup policy layer (blk-cgroup). The root cause is an ordering issue during asynchronous cleanup: the parent block group's refcount was dropped in __blkg_release() before pd_free_fn() callbacks are invoked in blkg_free_workfn(), but blkg_free_workfn() runs asynchronously. Some cgroup policies access parent policy data (pd) through child pd even after pd_offline_fn() completes; if the parent's pd_free_fn() executes before the child's, the child policy callbacks trigger UAF. The fix delays dropping the parent refcount until after pd_free_fn() is called for all child policies, ensuring proper cleanup ordering. The vulnerability is network-reachable only on systems where untrusted users can create or manipulate cgroups, though local privilege escalation is possible with cgroup write access.
Affected products
- Linux Linux kernel before upstream fix (commit c7241babf0855d8a6180cd1743ff0ec34de40b4e)
Timeline
- 2025-12-24: disclosed: CVE-2023-54107 published on NVD
- 2023-01-29: patched: Fix merged upstream by Jens Axboe (commit c7241babf0855d8a6180cd1743ff0ec34de40b4e)