CVE-2023-54293
Use-After-Free Vulnerability in Linux bcache Causes Kernel Crash
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a flaw in the Linux kernel's bcache subsystem related to the management of a linked list called btree_cache_wait. When multiple threads attempt to cannibalize cached btree nodes, only one thread can do so at a time, and others are added to this wait list. The issue occurs because the code fails to properly remove an operation from the btree_cache_wait list before freeing its memory, which damages the list structure and leads to kernel crashes due to list corruption.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to corruption of the btree_cache_wait linked list. Kernel crashes can lead to system instability, unexpected reboots, potential data loss, and denial of service conditions on affected systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel crash logs for messages related to 'list_add corruption' and invalid memory addresses in the bcache subsystem. Specifically, look for kernel log entries similar to 'list_add corruption. next->prev should be prev' and call traces involving bch_btree_check_thread, mca_cannibalize_lock, and related functions. Commands such as 'dmesg | grep -i "list_add corruption"' or 'journalctl -k | grep -i bcache' can help identify these crash signatures.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the bcache fix has been applied. The fix ensures that finish_wait() is called to properly remove operations from the btree_cache_wait list before freeing memory, and that bch_cannibalize_unlock() is called to release locks and wake up waiters, preventing list corruption and kernel crashes.