cbcvebase.
CVE-2023-54271
published 2025-12-30

CVE-2023-54271: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init…

PriorityP421medium5.5
EPSS
0.17%
7.1th percentile
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init blk-iocost sometimes causes the following crash: BUG: kernel NULL pointer dereference, address: 00000000000000e0 ... RIP: 0010:_raw_spin_lock+0x17/0x30 Code: be 01 02 00 00 e8 79 38 39 ff 31 d2 89 d0 5d c3 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 65 ff 05 48 d0 34 7e b9 01 00 00 00 31 c0 0f b1 0f 75 02 5d c3 89 c6 e8 ea 04 00 00 5d c3 0f 1f 84 00 00 RSP: 0018:ffffc900023b3d40 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 00000000000000e0 RCX: 0000000000000001 RDX: ffffc900023b3d20 RSI: ffffc900023b3cf0 RDI: 00000000000000e0 RBP: ffffc900023b3d40 R08: ffffc900023b3c10 R09: 0000000000000003 R10: 0000000000000064 R11: 000000000000000a R12: ffff888102337000 R13: fffffffffffffff2 R14: ffff88810af408c8 R15: ffff8881070c3600 FS: 00007faaaf364fc0(0000) GS:ffff88842fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000e0 CR3: 00000001097b1000 CR4: 0000000000350ea0 Call Trace: ioc_weight_write+0x13d/0x410 cgroup_file_write+0x7a/0x130 kernfs_fop_write_iter+0xf5/0x170 vfs_write+0x298/0x370 ksys_write+0x5f/0xb0 __x64_sys_write+0x1b/0x20 do_syscall_64+0x3d/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This happens because iocg->ioc is NULL. The field is initialized by ioc_pd_init() and never cleared. The NULL deref is caused by blkcg_activate_policy() installing blkg_policy_data before initializing it. blkcg_activate_policy() was doing the following: 1. Allocate pd's for all existing blkg's and install them in blkg->pd[]. 2. Initialize all pd's. 3. Online all pd's. blkcg_activate_policy() only grabs the queue_lock and may release and re-acquire the lock as allocation may need to sleep. ioc_weight_write() grabs blkcg->lock and iterates all its blkg's. The two can race and if ioc_weight_write() runs during #1 or between #1 and #2, it can encounter a pd which is not initialized yet, l

Affected

11 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.5.3-1 (forky)linux 6.5.3-1 (forky)
linuxlinux
linuxlinux>= 9d179b865449b351ad5cb76dbea480c9170d4a27 < da6cc648c1f570290af1ddbe6b7ca3d91b1d6db9da6cc648c1f570290af1ddbe6b7ca3d91b1d6db9
linuxlinux>= 9d179b865449b351ad5cb76dbea480c9170d4a27 < 33f0370bb7ce15a59d72a4d8a05421d334a04add33f0370bb7ce15a59d72a4d8a05421d334a04add
linuxlinux>= 9d179b865449b351ad5cb76dbea480c9170d4a27 < e39ef7880d1057b2ebcdb013405f4d84a257db23e39ef7880d1057b2ebcdb013405f4d84a257db23
linuxlinux>= 9d179b865449b351ad5cb76dbea480c9170d4a27 < 7d63c6f9765339dcfc34b7365ced7c518012e4fe7d63c6f9765339dcfc34b7365ced7c518012e4fe
linuxlinux>= 9d179b865449b351ad5cb76dbea480c9170d4a27 < ec14a87ee1999b19d8b7ed0fa95fea80644624aeec14a87ee1999b19d8b7ed0fa95fea80644624ae
linuxlinux_kernel>= 0 < 6.5.3-16.5.3-1
linuxlinux_kernel>= 0 < 6.5.3-16.5.3-1
linuxlinux_kernel>= 5.4.0 < 6.4.166.4.16
linuxlinux_kernel>= 6.5.0 < 6.5.36.5.3
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.