Executive brief
The Linux kernel's mount attribute handling contains a race condition in the failure cleanup path. A concurrent thread could change a mount's sharing properties while another thread is cleaning up peer group IDs, potentially leading to memory corruption or system instability. This affects systems that use namespace or mount propagation features.
Technical details
A race condition exists in the do_mount_setattr() function in fs/namespace.c. When cleaning up peer group IDs in the failure path following mount_setattr(), the namespace lock is released before calling cleanup_group_ids(). This creates a window where a concurrent thread can modify the mount's propagation state. The fix reorders operations to hold the namespace lock during peer group ID cleanup, preventing concurrent modification. The vulnerability affects kernels 5.12+ that include the mount_setattr() functionality and requires local access to trigger.
Affected products
- Linux Linux Kernel 5.12 and later (up to fixed versions)
Timeline
- 2023-03-30: disclosed
- 2023-04-13: patched
- 2025-12-24: other: CVE-2023-54128 published to NVD