Executive brief
A vulnerability in the Linux kernel's block control group (blk-cgroup) subsystem can cause a system crash. The issue occurs when the system attempts to manage disk I/O policies, leading to a 'NULL pointer dereference' that halts the operating system. This could be used by a local user to cause a denial-of-service, impacting the availability of the server or workstation.
Technical details
A race condition exists in blkcg_activate_policy() within the Linux kernel's block layer. The vulnerability is caused by installing blkg_policy_data (pd) into the blkg->pd[] array before it has been fully initialized by ioc_pd_init(). If a concurrent process, such as ioc_weight_write(), iterates through the blkg list and attempts to access the uninitialized pd while the queue_lock is temporarily released, it encounters a NULL pointer. This specifically affects the blk-iocost policy. The fix involves restructuring the activation sequence to allocate, initialize, and online each pd atomically while holding the blkcg->lock, ensuring that any installed policy data is always in a valid state.
Affected products
- Linux Linux Kernel 5.4 and later versions prior to 5.10.195, 5.15.132, 6.1.53, 6.5.3, and 6.6-rc1
Timeline
- 2023-08-16: disclosed: Initial patch authored by Tejun Heo
- 2023-09-13: patched: Patch committed to stable branches
- 2025-12-30: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/33f0370bb7ce15a59d72a4d8a05421d334a04add
- https://git.kernel.org/stable/c/7d63c6f9765339dcfc34b7365ced7c518012e4fe
- https://git.kernel.org/stable/c/da6cc648c1f570290af1ddbe6b7ca3d91b1d6db9
- https://git.kernel.org/stable/c/e39ef7880d1057b2ebcdb013405f4d84a257db23
- https://git.kernel.org/stable/c/ec14a87ee1999b19d8b7ed0fa95fea80644624ae