CVE-2023-53823: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53823 is a concurrency vulnerability in the Linux kernel's block layer rq_qos (request queue quality of service) subsystem. It was introduced when commit 50e34d78815e moved rq_qos_exit() from disk_release() to del_gendisk(), creating race conditions between disk teardown and QoS policy activation. The vulnerability affects the Linux kernel and was published on December 9, 2025. It carries a CVSS category estimate of Medium with an EPSS score of 0.000180 (Feedly).

The root cause is a race condition (CWE-362) in the Linux kernel's block/rq_qos subsystem arising from the relocation of rq_qos_exit() to del_gendisk(). Three distinct concurrency hazards exist: (1) concurrent writes to q->rq_qos when rq_qos_add() is triggered via cgroupfs (iocost/iolatency) while del_gendisk() runs simultaneously; (2) a null-pointer dereference in blkcg_activate_policy() if rq_qos_exit() is called mid-policy-activation; and (3) a memory leak when blkg_conf_open_bdev() finds a disk via blkdev_get_no_open() but rq_qos_exit() completes before rq_qos_add() executes. The fix introduces a new disk-level mutex rq_qos_mutex to serialize access to rq_qos_exit() and rq_qos_add() (Feedly).

Exploitation of this vulnerability can result in null-pointer dereferences causing kernel panics (denial of service), memory leaks leading to resource exhaustion, or memory corruption due to unsynchronized writes to kernel data structures. The impact is confined to the local system running the affected Linux kernel, primarily affecting availability and potentially integrity of kernel memory. Systems using cgroup-based I/O policies (iocost or iolatency) are at heightened risk (Feedly).

The fix is included in upstream Linux kernel patches available via the stable kernel tree (commits 16398b4638b5 and a13bd91be223). Users should update to a patched kernel version that includes the rq_qos_mutex fix. SUSE has issued advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1) incorporating this fix for their kernel packages (Feedly, Linux Security). As a workaround, avoiding dynamic enabling/disabling of iocost or iolatency cgroup policies on systems with active disk teardown operations can reduce exposure until a patched kernel is applied.