CVE-2023-54002: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54002 is a kernel assertion failure vulnerability in the Linux kernel's Btrfs filesystem subsystem, specifically in the exclusive operation (exclop) state machine when starting balance from a paused state. The flaw was published on December 24, 2025, and affects the Linux kernel across multiple stable branches. It arises from a race condition between concurrent device-add and balance operations that can trigger an assertion failure in fs/btrfs/ioctl.c. No CVSS score has been officially assigned at this time, and the CVE status is listed as Unknown (Feedly, CVE.org).

The root cause is an improper state validation (related to CWE-617: Reachable Assertion) in the Btrfs exclusive operation handling within btrfs_exclop_balance() in fs/btrfs/ioctl.c. Two race scenarios can trigger the assertion failure: (1) when btrfs_exclop_finish() completes and resets exclusive_operation to BTRFS_EXCLOP_NONE before the assertion in btrfs_exclop_balance is evaluated during concurrent device additions; and (2) when the state is BTRFS_EXCLOP_BALANCE_PAUSED during concurrent device-add and balance-start operations. The fix extends the assertion to account for the additional valid states (BTRFS_EXCLOP_NONE and BTRFS_EXCLOP_BALANCE_PAUSED) that are legitimately reachable under these race conditions. Patches are available in the stable kernel tree at multiple commit hashes (Feedly, kernel.org patch 1, kernel.org patch 2).

Successful triggering of this vulnerability causes a kernel assertion failure (panic/BUG) in the Btrfs ioctl path, resulting in a system crash and denial of service. The affected asset is any Linux system using the Btrfs filesystem where multiple threads concurrently attempt device-add and balance operations. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss due to the kernel crash (Feedly).

Apply the upstream Linux kernel patches that fix the assertion logic in btrfs_exclop_balance(). Patches have been committed to the stable kernel tree at commits 17eaeee4c5f2, 6062e9e335a3, 7877dc1136ad, and ac868bc9d136 (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3, kernel.org patch 4). As a workaround, avoid concurrently running btrfs device add and btrfs balance operations on the same filesystem mount point. Users should update to a patched kernel version as provided by their Linux distribution.