blk-cgroup: hold queue_lock when removing blkg->q_node

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2023-54088
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-12-24 13:16:10 UTC
Updated2026-08-04 10:19:28 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: blk-cgroup: hold queue_lock when removing blkg->q_node When blkg is removed from q->blkg_list from blkg_free_workfn(), queue_lock has to be held, otherwise, all kinds of bugs(list corruption, hard lockup, ..) can be triggered from blkg_destroy_all().

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001430000 probability, percentile 0.041000000 (date 2026-08-06)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 81c1188905f88b77743d1fdeeedfc8cb7b67787d b5dae1cd0d8368b4338430ff93403df67f0b8bcc git Not specified
CNA Linux Linux affected bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a 083b58373463a6e5ee60ecb135269348f68ad7df git Not specified
CNA Linux Linux affected f1c006f1c6850c14040f8337753a63119bba39b9 cd4ffdf56791eec95af01f06bee1ec7665ca75c4 git Not specified
CNA Linux Linux affected f1c006f1c6850c14040f8337753a63119bba39b9 c164c7bc9775be7bcc68754bb3431fce5823822e git Not specified
CNA Linux Linux affected 6.1.16 6.1.17 semver Not specified
CNA Linux Linux affected 6.2.3 6.2.4 semver Not specified
CNA Linux Linux affected 6.3 Not specified
CNA Linux Linux unaffected 6.3 semver Not specified
CNA Linux Linux unaffected 6.1.17 6.1.* semver Not specified
CNA Linux Linux unaffected 6.2.4 6.2.* semver Not specified
CNA Linux Linux unaffected 6.4.12 6.4.* semver Not specified
CNA Linux Linux unaffected 6.5 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/c164c7bc9775be7bcc68754bb3431fce5823822e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cd4ffdf56791eec95af01f06bee1ec7665ca75c4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/083b58373463a6e5ee60ecb135269348f68ad7df 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b5dae1cd0d8368b4338430ff93403df67f0b8bcc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report