CVE-2023-54281
published 2025-12-30CVE-2023-54281: In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before inode lookup during the ino lookup ioctl During the ino lookup…
PriorityP420low5.5
EPSS
0.17%
7.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
btrfs: release path before inode lookup during the ino lookup ioctl
During the ino lookup ioctl we can end up calling btrfs_iget() to get an
inode reference while we are holding on a root's btree. If btrfs_iget()
needs to lookup the inode from the root's btree, because it's not
currently loaded in memory, then it will need to lock another or the
same path in the same root btree. This may result in a deadlock and
trigger the following lockdep splat:
WARNING: possible circular locking dependency detected
6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 Not tainted
syz-executor277/5012 is trying to acquire lock:
ffff88802df41710 (btrfs-tree-01){++++}-{3:3}, at: __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136
but task is already holding lock:
ffff88802df418e8 (btrfs-tree-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (btrfs-tree-00){++++}-{3:3}:
down_read_nested+0x49/0x2f0 kernel/locking/rwsem.c:1645
__btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136
btrfs_search_slot+0x13a4/0x2f80 fs/btrfs/ctree.c:2302
btrfs_init_root_free_objectid+0x148/0x320 fs/btrfs/disk-io.c:4955
btrfs_init_fs_root fs/btrfs/disk-io.c:1128 [inline]
btrfs_get_root_ref+0x5ae/0xae0 fs/btrfs/disk-io.c:1338
btrfs_get_fs_root fs/btrfs/disk-io.c:1390 [inline]
open_ctree+0x29c8/0x3030 fs/btrfs/disk-io.c:3494
btrfs_fill_super+0x1c7/0x2f0 fs/btrfs/super.c:1154
btrfs_mount_root+0x7e0/0x910 fs/btrfs/super.c:1519
legacy_get_tree+0xef/0x190 fs/fs_context.c:611
vfs_get_tree+0x8c/0x270 fs/super.c:1519
fc_mount fs/namespace.c:1112 [inline]
vfs_kern_mount+0xbc/0x150 fs/namespace.c:1142
btrfs_mount+0x39f/0xb50 fs/btrfs/super.c:1579
legacy_get_tree+0xef/0x190 fs/fs_context.c:611
vfs_get_tree+0x8c/0x270 fs/super.c:1519
do_new_mount+0x28f/0xae0 fs/namespace.c:3335
do_mount fs/namespace.c:3675 [inline]
__do_
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.55-1 (bookworm) | linux 6.1.55-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 23d0b79dfaed2305b500b0215b0421701ada6b1a < 7390bb377b5fb3be23cb021e0f184d1f576be7d6 | 7390bb377b5fb3be23cb021e0f184d1f576be7d6 |
| linux | linux | >= 23d0b79dfaed2305b500b0215b0421701ada6b1a < 380bbd46d61c894a8dcaace09e54bc7426d81014 | 380bbd46d61c894a8dcaace09e54bc7426d81014 |
| linux | linux | >= 23d0b79dfaed2305b500b0215b0421701ada6b1a < 50e385d98b2a52480836ea41c142b81eeeb277af | 50e385d98b2a52480836ea41c142b81eeeb277af |
| linux | linux | >= 23d0b79dfaed2305b500b0215b0421701ada6b1a < 6fdce81e425be112f1ca129776f4041afeaad413 | 6fdce81e425be112f1ca129776f4041afeaad413 |
| linux | linux | >= 23d0b79dfaed2305b500b0215b0421701ada6b1a < ee34a82e890a7babb5585daf1a6dd7d4d1cf142a | ee34a82e890a7babb5585daf1a6dd7d4d1cf142a |
| linux | linux_kernel | >= 0 < 5.10.197-1 | 5.10.197-1 |
| linux | linux_kernel | >= 0 < 6.1.55-1 | 6.1.55-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 4.18.0 < 5.10.197 | 5.10.197 |
| linux | linux_kernel | >= 5.11.0 < 5.15.133 | 5.15.133 |
| linux | linux_kernel | >= 5.16.0 < 6.1.55 | 6.1.55 |
| linux | linux_kernel | >= 6.2.0 < 6.5.5 | 6.5.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
btrfs: release path before inode lookup during the ino lookup ioctl
osv·2025-12-30
CVE-2023-54281 btrfs: release path before inode lookup during the ino lookup ioctl
btrfs: release path before inode lookup during the ino lookup ioctl
In the Linux kernel, the following vulnerability has been resolved:
btrfs: release path before inode lookup during the ino lookup ioctl
During the ino lookup ioctl we can end up calling btrfs_iget() to get an
inode reference while we are holding on a root's btree. If btrfs_iget()
needs to lookup the inode from the root's btree, because it's not
currently loaded in memory, then it will need to lock another or the
same path in the same root btree. This may result in a deadlock and
trigger the following lockdep splat:
WARNING: possible circular locking dependency detected
6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 Not tainted
syz-executor277/5012 is trying to acquire lock:
ffff88802df41710 (btrfs-tree-01){++++}-{3:3}, at:
OSV
CVE-2023-54281: In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before inode lookup during the ino lookup ioctl During the ino
osv·2025-12-30
CVE-2023-54281 CVE-2023-54281: In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before inode lookup during the ino lookup ioctl During the ino
In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before inode lookup during the ino lookup ioctl During the ino lookup ioctl we can end up calling btrfs_iget() to get an inode reference while we are holding on a root's btree. If btrfs_iget() needs to lookup the inode from the root's btree, because it's not currently loaded in memory, then it will need to lock another or the same path in the same root btree. This may result in a deadlock and trigger the following lockdep splat: WARNING: possible circular locking dependency detected 6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 Not tainted ------------------------------------------------------ syz-executor277/5012 is trying to acquire lock: ffff88802df41710 (btrfs-tree-01){++++}-{3:3}, at: __btrfs_tree_rea
GHSA
GHSA-5q4r-9x8x-8xrp: In the Linux kernel, the following vulnerability has been resolved:
btrfs: release path before inode lookup during the ino lookup ioctl
During the i
ghsa_unreviewed·2025-12-30
CVE-2023-54281 GHSA-5q4r-9x8x-8xrp: In the Linux kernel, the following vulnerability has been resolved:
btrfs: release path before inode lookup during the ino lookup ioctl
During the i
In the Linux kernel, the following vulnerability has been resolved:
btrfs: release path before inode lookup during the ino lookup ioctl
During the ino lookup ioctl we can end up calling btrfs_iget() to get an
inode reference while we are holding on a root's btree. If btrfs_iget()
needs to lookup the inode from the root's btree, because it's not
currently loaded in memory, then it will need to lock another or the
same path in the same root btree. This may result in a deadlock and
trigger the following lockdep splat:
WARNING: possible circular locking dependency detected
6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 Not tainted
syz-executor277/5012 is trying to acquire lock:
ffff88802df41710 (btrfs-tree-01){++++}-{3:3}, at: __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136
but task i
Red Hat
kernel: btrfs: release path before inode lookup during the ino lookup ioctl
vendor_redhat·2025-12-30·CVSS 5.5
CVE-2023-54281 [LOW] CWE-833 kernel: btrfs: release path before inode lookup during the ino lookup ioctl
kernel: btrfs: release path before inode lookup during the ino lookup ioctl
In the Linux kernel, the following vulnerability has been resolved:
btrfs: release path before inode lookup during the ino lookup ioctl
During the ino lookup ioctl we can end up calling btrfs_iget() to get an
inode reference while we are holding on a root's btree. If btrfs_iget()
needs to lookup the inode from the root's btree, because it's not
currently loaded in memory, then it will need to lock another or the
same path in the same root btree. This may result in a deadlock and
trigger the following lockdep splat:
WARNING: possible circular locking dependency detected
6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 Not tainted
syz-executor277/5012 is trying to acquire lock:
ffff88802df41710 (btrfs-tree-01){++++}-{3:3}
Debian
CVE-2023-54281: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: rele...
vendor_debian·2023
CVE-2023-54281 CVE-2023-54281: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: rele...
In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before inode lookup during the ino lookup ioctl During the ino lookup ioctl we can end up calling btrfs_iget() to get an inode reference while we are holding on a root's btree. If btrfs_iget() needs to lookup the inode from the root's btree, because it's not currently loaded in memory, then it will need to lock another or the same path in the same root btree. This may result in a deadlock and trigger the following lockdep splat: WARNING: possible circular locking dependency detected 6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 Not tainted ------------------------------------------------------ syz-executor277/5012 is trying to acquire lock: ffff88802df41710 (btrfs-tree-01){++++}-{3:3}, at: __btrfs_tree_rea
No detection rules found.
No public exploits indexed.
Wiz
CVE-2023-54281 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-54281 CVE-2023-54281 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-54281 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
btrfs: release path before inode lookup during the ino lookup ioctl
During the ino lookup ioctl we can end up calling btrfs_iget() to get an
inode reference while we are holding on a root's btree. If btrfs_iget()
needs to lookup the inode from the root's btree, because it's not
currently loaded in memory, then it will need to lock another or the
same path in the same root btree. This may result in a deadlock and
trigger the following lockdep splat:
## WARNING: possible circular locking dependency detected
6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 Not tainted
syz-executor277/5012 is trying to acquire lock:
ffff88802df41710 (btrfs-tree-01){++++}-
Bugzilla
CVE-2023-54281 kernel: btrfs: release path before inode lookup during the ino lookup ioctl
bugzilla·2025-12-30
CVE-2023-54281 [LOW] CVE-2023-54281 kernel: btrfs: release path before inode lookup during the ino lookup ioctl
CVE-2023-54281 kernel: btrfs: release path before inode lookup during the ino lookup ioctl
In the Linux kernel, the following vulnerability has been resolved:
btrfs: release path before inode lookup during the ino lookup ioctl
During the ino lookup ioctl we can end up calling btrfs_iget() to get an
inode reference while we are holding on a root's btree. If btrfs_iget()
needs to lookup the inode from the root's btree, because it's not
currently loaded in memory, then it will need to lock another or the
same path in the same root btree. This may result in a deadlock and
trigger the following lockdep splat:
WARNING: possible circular locking dependency detected
6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 Not tainted
syz-executor277/5012 is trying to acquire lock:
ffff88802df41710 (btrfs-tr
https://git.kernel.org/stable/c/380bbd46d61c894a8dcaace09e54bc7426d81014https://git.kernel.org/stable/c/50e385d98b2a52480836ea41c142b81eeeb277afhttps://git.kernel.org/stable/c/6fdce81e425be112f1ca129776f4041afeaad413https://git.kernel.org/stable/c/7390bb377b5fb3be23cb021e0f184d1f576be7d6https://git.kernel.org/stable/c/ee34a82e890a7babb5585daf1a6dd7d4d1cf142a
2025-12-30
Published