cbcvebase.
CVE-2023-54281
published 2025-12-30

CVE-2023-54281: In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before inode lookup during the ino lookup ioctl During the ino lookup…

PriorityP420low5.5
EPSS
0.17%
7.1th percentile
In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before inode lookup during the ino lookup ioctl During the ino lookup ioctl we can end up calling btrfs_iget() to get an inode reference while we are holding on a root's btree. If btrfs_iget() needs to lookup the inode from the root's btree, because it's not currently loaded in memory, then it will need to lock another or the same path in the same root btree. This may result in a deadlock and trigger the following lockdep splat: WARNING: possible circular locking dependency detected 6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 Not tainted syz-executor277/5012 is trying to acquire lock: ffff88802df41710 (btrfs-tree-01){++++}-{3:3}, at: __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136 but task is already holding lock: ffff88802df418e8 (btrfs-tree-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (btrfs-tree-00){++++}-{3:3}: down_read_nested+0x49/0x2f0 kernel/locking/rwsem.c:1645 __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136 btrfs_search_slot+0x13a4/0x2f80 fs/btrfs/ctree.c:2302 btrfs_init_root_free_objectid+0x148/0x320 fs/btrfs/disk-io.c:4955 btrfs_init_fs_root fs/btrfs/disk-io.c:1128 [inline] btrfs_get_root_ref+0x5ae/0xae0 fs/btrfs/disk-io.c:1338 btrfs_get_fs_root fs/btrfs/disk-io.c:1390 [inline] open_ctree+0x29c8/0x3030 fs/btrfs/disk-io.c:3494 btrfs_fill_super+0x1c7/0x2f0 fs/btrfs/super.c:1154 btrfs_mount_root+0x7e0/0x910 fs/btrfs/super.c:1519 legacy_get_tree+0xef/0x190 fs/fs_context.c:611 vfs_get_tree+0x8c/0x270 fs/super.c:1519 fc_mount fs/namespace.c:1112 [inline] vfs_kern_mount+0xbc/0x150 fs/namespace.c:1142 btrfs_mount+0x39f/0xb50 fs/btrfs/super.c:1579 legacy_get_tree+0xef/0x190 fs/fs_context.c:611 vfs_get_tree+0x8c/0x270 fs/super.c:1519 do_new_mount+0x28f/0xae0 fs/namespace.c:3335 do_mount fs/namespace.c:3675 [inline] __do_

Affected

15 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.55-1 (bookworm)linux 6.1.55-1 (bookworm)
linuxlinux
linuxlinux>= 23d0b79dfaed2305b500b0215b0421701ada6b1a < 7390bb377b5fb3be23cb021e0f184d1f576be7d67390bb377b5fb3be23cb021e0f184d1f576be7d6
linuxlinux>= 23d0b79dfaed2305b500b0215b0421701ada6b1a < 380bbd46d61c894a8dcaace09e54bc7426d81014380bbd46d61c894a8dcaace09e54bc7426d81014
linuxlinux>= 23d0b79dfaed2305b500b0215b0421701ada6b1a < 50e385d98b2a52480836ea41c142b81eeeb277af50e385d98b2a52480836ea41c142b81eeeb277af
linuxlinux>= 23d0b79dfaed2305b500b0215b0421701ada6b1a < 6fdce81e425be112f1ca129776f4041afeaad4136fdce81e425be112f1ca129776f4041afeaad413
linuxlinux>= 23d0b79dfaed2305b500b0215b0421701ada6b1a < ee34a82e890a7babb5585daf1a6dd7d4d1cf142aee34a82e890a7babb5585daf1a6dd7d4d1cf142a
linuxlinux_kernel>= 0 < 5.10.197-15.10.197-1
linuxlinux_kernel>= 0 < 6.1.55-16.1.55-1
linuxlinux_kernel>= 0 < 6.5.6-16.5.6-1
linuxlinux_kernel>= 0 < 6.5.6-16.5.6-1
linuxlinux_kernel>= 4.18.0 < 5.10.1975.10.197
linuxlinux_kernel>= 5.11.0 < 5.15.1335.15.133
linuxlinux_kernel>= 5.16.0 < 6.1.556.1.55
linuxlinux_kernel>= 6.2.0 < 6.5.56.5.5
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.