CVE-2023-54023
Unknown Unknown - Not Provided
Race Condition in Linux btrfs Balance Causes Kernel Panic

Publication date: 2025-12-24

Last updated on: 2025-12-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between balance and cancel/pause Syzbot reported a panic that looks like this: assertion failed: fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE_PAUSED, in fs/btrfs/ioctl.c:465 ------------[ cut here ]------------ kernel BUG at fs/btrfs/messages.c:259! RIP: 0010:btrfs_assertfail+0x2c/0x30 fs/btrfs/messages.c:259 Call Trace: <TASK> btrfs_exclop_balance fs/btrfs/ioctl.c:465 [inline] btrfs_ioctl_balance fs/btrfs/ioctl.c:3564 [inline] btrfs_ioctl+0x531e/0x5b30 fs/btrfs/ioctl.c:4632 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The reproducer is running a balance and a cancel or pause in parallel. The way balance finishes is a bit wonky, if we were paused we need to save the balance_ctl in the fs_info, but clear it otherwise and cleanup. However we rely on the return values being specific errors, or having a cancel request or no pause request. If balance completes and returns 0, but we have a pause or cancel request we won't do the appropriate cleanup, and then the next time we try to start a balance we'll trip this ASSERT. The error handling is just wrong here, we always want to clean up, unless we got -ECANCELLED and we set the appropriate pause flag in the exclusive op. With this patch the reproducer ran for an hour without tripping, previously it would trip in less than a few minutes.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-24
Last Modified
2025-12-24
Generated
2026-05-07
AI Q&A
2025-12-24
EPSS Evaluated
2026-05-05
NVD
CVE-2023-54023
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a race condition in the Linux kernel's btrfs filesystem between the balance operation and cancel or pause requests. When a balance operation finishes, the error handling does not properly clean up if a pause or cancel request is pending but the balance returns success (0). This improper cleanup leads to an assertion failure and kernel panic when the next balance operation starts. The fix ensures proper cleanup unless the operation was cancelled with the appropriate pause flag set.


How can this vulnerability impact me? :

This vulnerability can cause the Linux kernel to panic and crash due to an assertion failure in the btrfs filesystem when balance and cancel or pause operations run in parallel. This can lead to system instability, potential data loss, or downtime on systems using btrfs.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by monitoring for kernel panics or assertion failures related to btrfs balance operations. Specifically, look for kernel messages containing 'assertion failed: fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE_PAUSED' or kernel BUGs in fs/btrfs/messages.c. You can check the kernel logs using commands like 'dmesg | grep btrfs' or 'journalctl -k | grep btrfs' to find such errors.


What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation involves avoiding running btrfs balance operations in parallel with cancel or pause commands, as the race condition occurs when these operations overlap. Applying the patch that fixes the error handling in the balance operation is the definitive fix. Until then, refrain from initiating balance and cancel/pause operations simultaneously to prevent triggering the kernel panic.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart