GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53823 (GCVE-0-2023-53823)

Vulnerability from cvelistv5 – Published: 2025-12-09 01:29 – Updated: 2026-08-05 09:16
VLAI
Title
block/rq_qos: protect rq_qos apis with a new lock
Summary
In the Linux kernel, the following vulnerability has been resolved: block/rq_qos: protect rq_qos apis with a new lock commit 50e34d78815e ("block: disable the elevator int del_gendisk") move rq_qos_exit() from disk_release() to del_gendisk(), this will introduce some problems: 1) If rq_qos_add() is triggered by enabling iocost/iolatency through cgroupfs, then it can concurrent with del_gendisk(), it's not safe to write 'q->rq_qos' concurrently. 2) Activate cgroup policy that is relied on rq_qos will call rq_qos_add() and blkcg_activate_policy(), and if rq_qos_exit() is called in the middle, null-ptr-dereference will be triggered in blkcg_activate_policy(). 3) blkg_conf_open_bdev() can call blkdev_get_no_open() first to find the disk, then if rq_qos_exit() from del_gendisk() is done before rq_qos_add(), then memory will be leaked. This patch add a new disk level mutex 'rq_qos_mutex': 1) The lock will protect rq_qos_exit() directly. 2) For wbt that doesn't relied on blk-cgroup, rq_qos_add() can only be called from disk initialization for now because wbt can't be destructed until rq_qos_exit(), so it's safe not to protect wbt for now. Hoever, in case that rq_qos dynamically destruction is supported in the furture, this patch also protect rq_qos_add() from wbt_init() directly, this is enough because blk-sysfs already synchronize writers with disk removal. 3) For iocost and iolatency, in order to synchronize disk removal and cgroup configuration, the lock is held after blkdev_get_no_open() from blkg_conf_open_bdev(), and is released in blkg_conf_exit(). In order to fix the above memory leak, disk_live() is checked after holding the new lock.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 50e34d78815e474d410f342fbe783b18192ca518 , < 16398b4638b5cd8c1dc95fc940a1591a801d53ce (git)
Affected: 50e34d78815e474d410f342fbe783b18192ca518 , < a13bd91be22318768d55470cbc0b0f4488ef9edf (git)
Affected: f28699fafc047ec33299da01e928c3a0073c5cc6 (git)
Affected: 5.18.8 , < 5.19 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.4.4 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c",
            "block/blk-core.c",
            "block/blk-rq-qos.c",
            "block/blk-wbt.c",
            "include/linux/blkdev.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "16398b4638b5cd8c1dc95fc940a1591a801d53ce",
              "status": "affected",
              "version": "50e34d78815e474d410f342fbe783b18192ca518",
              "versionType": "git"
            },
            {
              "lessThan": "a13bd91be22318768d55470cbc0b0f4488ef9edf",
              "status": "affected",
              "version": "50e34d78815e474d410f342fbe783b18192ca518",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f28699fafc047ec33299da01e928c3a0073c5cc6",
              "versionType": "git"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c",
            "block/blk-core.c",
            "block/blk-rq-qos.c",
            "block/blk-wbt.c",
            "include/linux/blkdev.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.4",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock/rq_qos: protect rq_qos apis with a new lock\n\ncommit 50e34d78815e (\"block: disable the elevator int del_gendisk\")\nmove rq_qos_exit() from disk_release() to del_gendisk(), this will\nintroduce some problems:\n\n1) If rq_qos_add() is triggered by enabling iocost/iolatency through\n   cgroupfs, then it can concurrent with del_gendisk(), it\u0027s not safe to\n   write \u0027q-\u003erq_qos\u0027 concurrently.\n\n2) Activate cgroup policy that is relied on rq_qos will call\n   rq_qos_add() and blkcg_activate_policy(), and if rq_qos_exit() is\n   called in the middle, null-ptr-dereference will be triggered in\n   blkcg_activate_policy().\n\n3) blkg_conf_open_bdev() can call blkdev_get_no_open() first to find the\n   disk, then if rq_qos_exit() from del_gendisk() is done before\n   rq_qos_add(), then memory will be leaked.\n\nThis patch add a new disk level mutex \u0027rq_qos_mutex\u0027:\n\n1) The lock will protect rq_qos_exit() directly.\n\n2) For wbt that doesn\u0027t relied on blk-cgroup, rq_qos_add() can only be\n   called from disk initialization for now because wbt can\u0027t be\n   destructed until rq_qos_exit(), so it\u0027s safe not to protect wbt for\n   now. Hoever, in case that rq_qos dynamically destruction is supported\n   in the furture, this patch also protect rq_qos_add() from wbt_init()\n   directly, this is enough because blk-sysfs already synchronize\n   writers with disk removal.\n\n3) For iocost and iolatency, in order to synchronize disk removal and\n   cgroup configuration, the lock is held after blkdev_get_no_open()\n   from blkg_conf_open_bdev(), and is released in blkg_conf_exit().\n   In order to fix the above memory leak, disk_live() is checked after\n   holding the new lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Both sides of the race are driven through local interfaces \u2014 a cgroupfs write to `io.latency`/`io.cost.qos` reaching `rq_qos_add()`, and a block-device removal reaching `del_gendisk()`\u2192`rq_qos_exit()`. There is no remote or network-facing path into the block rq_qos layer.\nAC:L - The attacker controls both sides: they can loop the `io.latency` write against any device by MAJ:MIN (no permission check in `blkg_conf_open_bdev()`) while triggering repeated disk teardown (loop/nbd device delete), and can stretch the `rq_qos_add()`\u2192`timer_setup()` window arbitrarily by populating the queue with thousands of blkgs so `blkcg_activate_policy()` spends a long time in GFP_KERNEL allocation and retry.\nPR:L - No capability check exists on the path \u2014 `iolatency_set_limit()`/`blkg_conf_open_bdev()` gate only on cgroupfs file permissions, and `cgroup_add_file()` creates interface files owned by `current_fsuid()`, so an unprivileged user with a delegated cgroup v2 subtree (systemd delegation, container runtimes) can write `io.latency` and target any block device on the system.\nUI:N - The attacker performs both the cgroup configuration write and the disk removal themselves; no action by any other user or administrator is needed.\nS:U - The corruption is confined to kernel heap objects and the block layer\u0027s request_queue within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The unsynchronized `q-\u003erq_qos` update leaves freed `rq_qos` objects linked in the chain and dangling `blk_iolatency`/gendisk pointers, giving a use-after-free read primitive over reclaimed slab memory that can be groomed to disclose arbitrary kernel data.\nI:H - `blk_iolatency_init()` continues writing (`timer_setup()`, `INIT_WORK()`) into the object already freed by `blkcg_iolatency_exit()`, and `__rq_qos_throttle()` performs an indirect call through `rqos-\u003eops-\u003ethrottle` read from freed memory \u2014 a heap-spray-controllable arbitrary write and control-flow hijack.\nA:H - The race reliably produces kernel oopses \u2014 a NULL dereference through `iolat-\u003eblkiolat` set to NULL by `iolatency_pd_init()`, plus use-after-free faults on the rq_qos chain during I/O submission and from the leaked object\u0027s timer firing after the disk is released."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:14.720Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/16398b4638b5cd8c1dc95fc940a1591a801d53ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/a13bd91be22318768d55470cbc0b0f4488ef9edf"
        }
      ],
      "title": "block/rq_qos: protect rq_qos apis with a new lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53823",
    "datePublished": "2025-12-09T01:29:36.343Z",
    "dateReserved": "2025-12-09T01:27:17.824Z",
    "dateUpdated": "2026-08-05T09:16:14.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53823",
      "date": "2026-09-18",
      "epss": "0.00183",
      "percentile": "0.08164"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "block/blk-cgroup.c",
                  "block/blk-core.c",
                  "block/blk-rq-qos.c",
                  "block/blk-wbt.c",
                  "include/linux/blkdev.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "16398b4638b5cd8c1dc95fc940a1591a801d53ce",
                    "status": "affected",
                    "version": "50e34d78815e474d410f342fbe783b18192ca518",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a13bd91be22318768d55470cbc0b0f4488ef9edf",
                    "status": "affected",
                    "version": "50e34d78815e474d410f342fbe783b18192ca518",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "f28699fafc047ec33299da01e928c3a0073c5cc6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "affected",
                    "version": "5.18.8",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "block/blk-cgroup.c",
                  "block/blk-core.c",
                  "block/blk-rq-qos.c",
                  "block/blk-wbt.c",
                  "include/linux/blkdev.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.4.*",
                    "status": "unaffected",
                    "version": "6.4.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.5",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock/rq_qos: protect rq_qos apis with a new lock\n\ncommit 50e34d78815e (\"block: disable the elevator int del_gendisk\")\nmove rq_qos_exit() from disk_release() to del_gendisk(), this will\nintroduce some problems:\n\n1) If rq_qos_add() is triggered by enabling iocost/iolatency through\n   cgroupfs, then it can concurrent with del_gendisk(), it\u0027s not safe to\n   write \u0027q-\u003erq_qos\u0027 concurrently.\n\n2) Activate cgroup policy that is relied on rq_qos will call\n   rq_qos_add() and blkcg_activate_policy(), and if rq_qos_exit() is\n   called in the middle, null-ptr-dereference will be triggered in\n   blkcg_activate_policy().\n\n3) blkg_conf_open_bdev() can call blkdev_get_no_open() first to find the\n   disk, then if rq_qos_exit() from del_gendisk() is done before\n   rq_qos_add(), then memory will be leaked.\n\nThis patch add a new disk level mutex \u0027rq_qos_mutex\u0027:\n\n1) The lock will protect rq_qos_exit() directly.\n\n2) For wbt that doesn\u0027t relied on blk-cgroup, rq_qos_add() can only be\n   called from disk initialization for now because wbt can\u0027t be\n   destructed until rq_qos_exit(), so it\u0027s safe not to protect wbt for\n   now. Hoever, in case that rq_qos dynamically destruction is supported\n   in the furture, this patch also protect rq_qos_add() from wbt_init()\n   directly, this is enough because blk-sysfs already synchronize\n   writers with disk removal.\n\n3) For iocost and iolatency, in order to synchronize disk removal and\n   cgroup configuration, the lock is held after blkdev_get_no_open()\n   from blkg_conf_open_bdev(), and is released in blkg_conf_exit().\n   In order to fix the above memory leak, disk_live() is checked after\n   holding the new lock."
          }
        ],
        "id": "CVE-2023-53823",
        "lastModified": "2026-08-04T10:19:22.933",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-09T16:17:21.107",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/16398b4638b5cd8c1dc95fc940a1591a801d53ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a13bd91be22318768d55470cbc0b0f4488ef9edf"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:54:26+00:00",
      "cve": "CVE-2023-53823",
      "id": "CVE-2023-53823",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "36",
      "product_status:known_not_affected": "152",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: block/rq_qos: protect rq_qos apis with a new lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53823.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:45:56Z",
      "cve": "CVE-2023-53823",
      "id": "CVE-2023-53823",
      "initial_release_date": "2025-12-10T00:35:25Z",
      "product_status:known_affected": "461",
      "product_status:known_not_affected": "365",
      "product_status:recommended": "241",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53823",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53823.json",
      "version": "29"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.