{"api_version":"1","generated_at":"2026-10-29T10:56:51+00:00","cve":"CVE-2023-54067","urls":{"html":"https://cve.report/CVE-2023-54067","api":"https://cve.report/api/cve/CVE-2023-54067.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-54067","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-54067"},"summary":{"title":"btrfs: fix race when deleting free space root from the dirty cow roots list","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race when deleting free space root from the dirty cow roots list\n\nWhen deleting the free space tree we are deleting the free space root\nfrom the list fs_info->dirty_cowonly_roots without taking the lock that\nprotects it, which is struct btrfs_fs_info::trans_lock.\nThis unsynchronized list manipulation may cause chaos if there's another\nconcurrent manipulation of this list, such as when adding a root to it\nwith ctree.c:add_root_to_dirty_list().\n\nThis can result in all sorts of weird failures caused by a race, such as\nthe following crash:\n\n  [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI\n  [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G        W          6.4.0-rc6-btrfs-next-134+ #1\n  [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n  [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]\n  [337571.279928] Code: 85 38 06 00 (...)\n  [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206\n  [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000\n  [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070\n  [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b\n  [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600\n  [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48\n  [337571.281723] FS:  00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000\n  [337571.281950] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0\n  [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  [337571.282874] Call Trace:\n  [337571.283101]  <TASK>\n  [337571.283327]  ? __die_body+0x1b/0x60\n  [337571.283570]  ? die_addr+0x39/0x60\n  [337571.283796]  ? exc_general_protection+0x22e/0x430\n  [337571.284022]  ? asm_exc_general_protection+0x22/0x30\n  [337571.284251]  ? commit_cowonly_roots+0x11f/0x250 [btrfs]\n  [337571.284531]  btrfs_commit_transaction+0x42e/0xf90 [btrfs]\n  [337571.284803]  ? _raw_spin_unlock+0x15/0x30\n  [337571.285031]  ? release_extent_buffer+0x103/0x130 [btrfs]\n  [337571.285305]  reset_balance_state+0x152/0x1b0 [btrfs]\n  [337571.285578]  btrfs_balance+0xa50/0x11e0 [btrfs]\n  [337571.285864]  ? __kmem_cache_alloc_node+0x14a/0x410\n  [337571.286086]  btrfs_ioctl+0x249a/0x3320 [btrfs]\n  [337571.286358]  ? mod_objcg_state+0xd2/0x360\n  [337571.286577]  ? refill_obj_stock+0xb0/0x160\n  [337571.286798]  ? seq_release+0x25/0x30\n  [337571.287016]  ? __rseq_handle_notify_resume+0x3ba/0x4b0\n  [337571.287235]  ? percpu_counter_add_batch+0x2e/0xa0\n  [337571.287455]  ? __x64_sys_ioctl+0x88/0xc0\n  [337571.287675]  __x64_sys_ioctl+0x88/0xc0\n  [337571.287901]  do_syscall_64+0x38/0x90\n  [337571.288126]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\n  [337571.288352] RIP: 0033:0x7f478aaffe9b\n\nSo fix this by locking struct btrfs_fs_info::trans_lock before deleting\nthe free space root from that list.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-12-24 13:16:08","updated_at":"2026-08-04 10:19:27"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/babebf023e661b90b1c78b2baa384fb03a226879","name":"https://git.kernel.org/stable/c/babebf023e661b90b1c78b2baa384fb03a226879","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6f1c81886b0b56cb88b311e5d2f203625474d892","name":"https://git.kernel.org/stable/c/6f1c81886b0b56cb88b311e5d2f203625474d892","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8ce9139aea5e60a247bde5af804312f54975f443","name":"https://git.kernel.org/stable/c/8ce9139aea5e60a247bde5af804312f54975f443","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-54067","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54067","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a5ed91828518ab076209266c2bc510adabd078df 6f1c81886b0b56cb88b311e5d2f203625474d892 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a5ed91828518ab076209266c2bc510adabd078df 8ce9139aea5e60a247bde5af804312f54975f443 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a5ed91828518ab076209266c2bc510adabd078df babebf023e661b90b1c78b2baa384fb03a226879 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.5","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.39 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.4.4 6.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.5 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2023","cve_id":"54067","cve":"CVE-2023-54067","epss":"0.001390000","percentile":"0.036770000","score_date":"2026-08-06","updated_at":"2026-08-07 00:14:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/free-space-tree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6f1c81886b0b56cb88b311e5d2f203625474d892","status":"affected","version":"a5ed91828518ab076209266c2bc510adabd078df","versionType":"git"},{"lessThan":"8ce9139aea5e60a247bde5af804312f54975f443","status":"affected","version":"a5ed91828518ab076209266c2bc510adabd078df","versionType":"git"},{"lessThan":"babebf023e661b90b1c78b2baa384fb03a226879","status":"affected","version":"a5ed91828518ab076209266c2bc510adabd078df","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/free-space-tree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.39","versionType":"semver"},{"lessThanOrEqual":"6.4.*","status":"unaffected","version":"6.4.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.5","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.39","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.4","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.5","versionStartIncluding":"4.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race when deleting free space root from the dirty cow roots list\n\nWhen deleting the free space tree we are deleting the free space root\nfrom the list fs_info->dirty_cowonly_roots without taking the lock that\nprotects it, which is struct btrfs_fs_info::trans_lock.\nThis unsynchronized list manipulation may cause chaos if there's another\nconcurrent manipulation of this list, such as when adding a root to it\nwith ctree.c:add_root_to_dirty_list().\n\nThis can result in all sorts of weird failures caused by a race, such as\nthe following crash:\n\n  [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI\n  [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G        W          6.4.0-rc6-btrfs-next-134+ #1\n  [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n  [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]\n  [337571.279928] Code: 85 38 06 00 (...)\n  [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206\n  [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000\n  [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070\n  [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b\n  [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600\n  [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48\n  [337571.281723] FS:  00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000\n  [337571.281950] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0\n  [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  [337571.282874] Call Trace:\n  [337571.283101]  <TASK>\n  [337571.283327]  ? __die_body+0x1b/0x60\n  [337571.283570]  ? die_addr+0x39/0x60\n  [337571.283796]  ? exc_general_protection+0x22e/0x430\n  [337571.284022]  ? asm_exc_general_protection+0x22/0x30\n  [337571.284251]  ? commit_cowonly_roots+0x11f/0x250 [btrfs]\n  [337571.284531]  btrfs_commit_transaction+0x42e/0xf90 [btrfs]\n  [337571.284803]  ? _raw_spin_unlock+0x15/0x30\n  [337571.285031]  ? release_extent_buffer+0x103/0x130 [btrfs]\n  [337571.285305]  reset_balance_state+0x152/0x1b0 [btrfs]\n  [337571.285578]  btrfs_balance+0xa50/0x11e0 [btrfs]\n  [337571.285864]  ? __kmem_cache_alloc_node+0x14a/0x410\n  [337571.286086]  btrfs_ioctl+0x249a/0x3320 [btrfs]\n  [337571.286358]  ? mod_objcg_state+0xd2/0x360\n  [337571.286577]  ? refill_obj_stock+0xb0/0x160\n  [337571.286798]  ? seq_release+0x25/0x30\n  [337571.287016]  ? __rseq_handle_notify_resume+0x3ba/0x4b0\n  [337571.287235]  ? percpu_counter_add_batch+0x2e/0xa0\n  [337571.287455]  ? __x64_sys_ioctl+0x88/0xc0\n  [337571.287675]  __x64_sys_ioctl+0x88/0xc0\n  [337571.287901]  do_syscall_64+0x38/0x90\n  [337571.288126]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\n  [337571.288352] RIP: 0033:0x7f478aaffe9b\n\nSo fix this by locking struct btrfs_fs_info::trans_lock before deleting\nthe free space root from that list."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-08-04T09:17:26.337Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/6f1c81886b0b56cb88b311e5d2f203625474d892"},{"url":"https://git.kernel.org/stable/c/8ce9139aea5e60a247bde5af804312f54975f443"},{"url":"https://git.kernel.org/stable/c/babebf023e661b90b1c78b2baa384fb03a226879"}],"title":"btrfs: fix race when deleting free space root from the dirty cow roots list","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2023-54067","datePublished":"2025-12-24T12:23:12.109Z","dateReserved":"2025-12-24T12:21:05.092Z","dateUpdated":"2026-08-04T09:17:26.337Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-12-24 13:16:08","lastModifiedDate":"2026-08-04 10:19:27","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"54067","Ordinal":"1","Title":"btrfs: fix race when deleting free space root from the dirty cow","CVE":"CVE-2023-54067","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"54067","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race when deleting free space root from the dirty cow roots list\n\nWhen deleting the free space tree we are deleting the free space root\nfrom the list fs_info->dirty_cowonly_roots without taking the lock that\nprotects it, which is struct btrfs_fs_info::trans_lock.\nThis unsynchronized list manipulation may cause chaos if there's another\nconcurrent manipulation of this list, such as when adding a root to it\nwith ctree.c:add_root_to_dirty_list().\n\nThis can result in all sorts of weird failures caused by a race, such as\nthe following crash:\n\n  [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI\n  [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G        W          6.4.0-rc6-btrfs-next-134+ #1\n  [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n  [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]\n  [337571.279928] Code: 85 38 06 00 (...)\n  [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206\n  [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000\n  [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070\n  [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b\n  [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600\n  [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48\n  [337571.281723] FS:  00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000\n  [337571.281950] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0\n  [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  [337571.282874] Call Trace:\n  [337571.283101]  <TASK>\n  [337571.283327]  ? __die_body+0x1b/0x60\n  [337571.283570]  ? die_addr+0x39/0x60\n  [337571.283796]  ? exc_general_protection+0x22e/0x430\n  [337571.284022]  ? asm_exc_general_protection+0x22/0x30\n  [337571.284251]  ? commit_cowonly_roots+0x11f/0x250 [btrfs]\n  [337571.284531]  btrfs_commit_transaction+0x42e/0xf90 [btrfs]\n  [337571.284803]  ? _raw_spin_unlock+0x15/0x30\n  [337571.285031]  ? release_extent_buffer+0x103/0x130 [btrfs]\n  [337571.285305]  reset_balance_state+0x152/0x1b0 [btrfs]\n  [337571.285578]  btrfs_balance+0xa50/0x11e0 [btrfs]\n  [337571.285864]  ? __kmem_cache_alloc_node+0x14a/0x410\n  [337571.286086]  btrfs_ioctl+0x249a/0x3320 [btrfs]\n  [337571.286358]  ? mod_objcg_state+0xd2/0x360\n  [337571.286577]  ? refill_obj_stock+0xb0/0x160\n  [337571.286798]  ? seq_release+0x25/0x30\n  [337571.287016]  ? __rseq_handle_notify_resume+0x3ba/0x4b0\n  [337571.287235]  ? percpu_counter_add_batch+0x2e/0xa0\n  [337571.287455]  ? __x64_sys_ioctl+0x88/0xc0\n  [337571.287675]  __x64_sys_ioctl+0x88/0xc0\n  [337571.287901]  do_syscall_64+0x38/0x90\n  [337571.288126]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\n  [337571.288352] RIP: 0033:0x7f478aaffe9b\n\nSo fix this by locking struct btrfs_fs_info::trans_lock before deleting\nthe free space root from that list.","Type":"Description","Title":"btrfs: fix race when deleting free space root from the dirty cow"}]}}}