CVE-2023-53765: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53765 is a kernel vulnerability in the Linux device-mapper (dm) cache subsystem caused by incomplete cleanup of background tracker work objects during destruction. Specifically, btracker_destroy fails to free queued work items before destroying the slab cache, which can trigger a kernel BUG (BUG bt_work: Objects remaining in bt_work on __kmem_cache_shutdown()). The vulnerability affects the Linux kernel and was publicly disclosed on December 8, 2025. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper resource cleanup (CWE-459: Incomplete Cleanup) in the btracker_destroy function within the dm_cache kernel module. When the background tracker is destroyed — for example, during an LVM device removal — queued work items in the bt_work slab cache are not flushed or cancelled before kmem_cache_destroy is called, leaving live objects in the cache. This was exposed by commit 0495e337b703 (mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock), which changed slab teardown behavior and surfaced the pre-existing incomplete cleanup. The bug is triggered via the ctl_ioctl → dev_remove → __dm_destroy → btracker_destroy call chain, as shown in the kernel stack trace (Red Hat Bugzilla).

Successful exploitation by a low-privileged local attacker can cause a kernel BUG or WARNING, leading to system instability or a kernel crash (denial of service). The CVSS assessment also rates confidentiality and integrity impacts as high, suggesting potential for privilege escalation or memory corruption in certain conditions. The affected scope is limited to systems using the Linux dm-cache subsystem (e.g., systems with LVM thin provisioning or caching configurations) (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at approximately 0.017%, reflecting minimal near-term exploitation probability. Exploitation requires low-privilege local access and high attack complexity, limiting the practical attack surface (Red Hat Advisory).

• Logs: Kernel logs (dmesg or /var/log/kern.log) containing BUG bt_work or Objects remaining in bt_work on __kmem_cache_shutdown() messages; WARNING from kmem_cache_destroy referencing btracker_destroy.
• Process: Unusual crashes or hangs of the lvm process or device-mapper related processes during device removal operations.
• System: Unexpected kernel panics or system reboots on hosts using LVM with dm-cache or dm-cache-smq policies.

The fix involves flushing or cancelling queued work items in btracker_destroy before calling kmem_cache_destroy, and patches have been committed to the stable Linux kernel tree (e.g., commits 95ab80a8a0fe, 673a3af21d5e, ed56ad5cacb7). Users should update to a patched kernel version provided by their Linux distribution. As a workaround, restricting local user access to device-mapper operations and avoiding dm-cache device teardown on unpatched systems can reduce exposure (Red Hat Bugzilla, Red Hat Advisory).