cbcvebase.
CVE-2023-54134
published 2025-12-24

CVE-2023-54134: In the Linux kernel, the following vulnerability has been resolved: autofs: fix memory leak of waitqueues in autofs_catatonic_mode Syzkaller reports a memory…

PriorityP421low5.5
EPSS
0.21%
10.8th percentile
In the Linux kernel, the following vulnerability has been resolved: autofs: fix memory leak of waitqueues in autofs_catatonic_mode Syzkaller reports a memory leak: BUG: memory leak unreferenced object 0xffff88810b279e00 (size 96): comm "syz-executor399", pid 3631, jiffies 4294964921 (age 23.870s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 08 9e 27 0b 81 88 ff ff ..........'..... 08 9e 27 0b 81 88 ff ff 00 00 00 00 00 00 00 00 ..'............. backtrace: [] kmalloc_trace+0x20/0x90 mm/slab_common.c:1046 [] kmalloc include/linux/slab.h:576 [inline] [] autofs_wait+0x3fa/0x9a0 fs/autofs/waitq.c:378 [] autofs_do_expire_multi+0xa7/0x3e0 fs/autofs/expire.c:593 [] autofs_expire_multi+0x53/0x80 fs/autofs/expire.c:619 [] autofs_root_ioctl_unlocked+0x322/0x3b0 fs/autofs/root.c:897 [] autofs_root_ioctl+0x25/0x30 fs/autofs/root.c:910 [] vfs_ioctl fs/ioctl.c:51 [inline] [] __do_sys_ioctl fs/ioctl.c:870 [inline] [] __se_sys_ioctl fs/ioctl.c:856 [inline] [] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:856 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd autofs_wait_queue structs should be freed if their wait_ctr becomes zero. Otherwise they will be lost. In this case an AUTOFS_IOC_EXPIRE_MULTI ioctl is done, then a new waitqueue struct is allocated in autofs_wait(), its initial wait_ctr equals 2. After that wait_event_killable() is interrupted (it returns -ERESTARTSYS), so that 'wq->name.name == NULL' condition may be not satisfied. Actually, this condition can be satisfied when autofs_wait_release() or autofs_catatonic_mode() is called and, what is also important, wait_ctr is decremented in those places. Upon the exit of autofs_wait(), wait_ctr is decremented to 1. Then the unmounting process begins: kill_sb calls autofs_catatonic_mode(), which should have freed the waitqueues, but it only decrements its usage counter to zero which is not a correct behaviour. edit:imk This

Affected

21 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.55-1 (bookworm)linux 6.1.55-1 (bookworm)
linuxlinux——
linuxlinux>= 296f7bf78bc5c7a4d772aea580ce800d14040d1a < 1985e8eae8627f02e3364690c5fed7af1c46be551985e8eae8627f02e3364690c5fed7af1c46be55
linuxlinux>= 296f7bf78bc5c7a4d772aea580ce800d14040d1a < 976abbdc120a97049b9133e60fa7b29627d11de4976abbdc120a97049b9133e60fa7b29627d11de4
linuxlinux>= 296f7bf78bc5c7a4d772aea580ce800d14040d1a < 6079dc77c6f32936e8a6766ee8334ae3c99f45046079dc77c6f32936e8a6766ee8334ae3c99f4504
linuxlinux>= 296f7bf78bc5c7a4d772aea580ce800d14040d1a < 69ddafc7a7afd8401bab53eff5af813fa0d368a269ddafc7a7afd8401bab53eff5af813fa0d368a2
linuxlinux>= 296f7bf78bc5c7a4d772aea580ce800d14040d1a < 71eeddcad7342292c19042c290c477697acaccab71eeddcad7342292c19042c290c477697acaccab
linuxlinux>= 296f7bf78bc5c7a4d772aea580ce800d14040d1a < 726deae613bc1b6096ad3b61cc1e63e33330fbc2726deae613bc1b6096ad3b61cc1e63e33330fbc2
linuxlinux>= 296f7bf78bc5c7a4d772aea580ce800d14040d1a < 696b625f3f85d80fca48c24d2948fbc451e74366696b625f3f85d80fca48c24d2948fbc451e74366
linuxlinux>= 296f7bf78bc5c7a4d772aea580ce800d14040d1a < ccbe77f7e45dfb4420f7f531b650c00c6e9c7507ccbe77f7e45dfb4420f7f531b650c00c6e9c7507
linuxlinux_kernel>= 0 < 5.10.197-15.10.197-1
linuxlinux_kernel>= 0 < 6.1.55-16.1.55-1
linuxlinux_kernel>= 0 < 6.5.6-16.5.6-1
linuxlinux_kernel>= 0 < 6.5.6-16.5.6-1
linuxlinux_kernel>= 2.6.27 < 4.14.3264.14.326
linuxlinux_kernel>= 4.15.0 < 4.19.2954.19.295
linuxlinux_kernel>= 4.20.0 < 5.4.2575.4.257
linuxlinux_kernel>= 5.11.0 < 5.15.1335.15.133
linuxlinux_kernel>= 5.16.0 < 6.1.556.1.55
linuxlinux_kernel>= 5.5.0 < 5.10.1975.10.197
linuxlinux_kernel>= 6.2.0 < 6.5.56.5.5
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.