CVE-2023-54067: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54067 is a race condition vulnerability in the Linux kernel's Btrfs filesystem subsystem. It involves the deletion of the free space root from the fs_info->dirty_cowonly_roots list without holding the protecting lock (btrfs_fs_info::trans_lock), which can lead to unsynchronized list manipulation and kernel crashes. The vulnerability was published on December 24, 2025, and affects the Linux kernel. It carries an EPSS score of 0.017% (low), indicating limited exploitation probability (Feedly).

The root cause is a race condition (CWE-362) in the Btrfs free space tree deletion path. When deleting the free space tree, the kernel removes the free space root from fs_info->dirty_cowonly_roots without acquiring btrfs_fs_info::trans_lock, the spinlock that serializes access to this list. A concurrent call to ctree.c:add_root_to_dirty_list() can simultaneously modify the same list, resulting in list corruption. This manifests as a general protection fault crash in commit_cowonly_roots(), as demonstrated by a crash at address 0xdead000000000100 (a poison pointer indicating a use-after-free or list corruption scenario) on kernel version 6.4.0-rc6 (Feedly).

Successful triggering of this race condition results in a kernel general protection fault and system crash, impacting availability. The crash occurs in the Btrfs transaction commit path, meaning any system using Btrfs as its filesystem and performing concurrent free space tree operations (such as enabling/disabling the free space tree feature) is at risk of an unplanned reboot. There is no evidence of confidentiality or integrity impact beyond the crash itself, and exploitation requires local access to trigger the specific concurrent operations (Feedly).

The Linux kernel maintainers have issued patches addressing this race condition by ensuring the trans_lock is held when removing the free space root from dirty_cowonly_roots. Fixes are available in the stable kernel tree via commits 6f1c81886b0b, 8ce9139aea5e, and babebf023e661b (kernel.org). Downstream distributions such as SUSE have also released updated kernel packages incorporating this fix (e.g., SUSE advisories SUSE-2026-0281-1 and SUSE-2026-20876-1). Users should update to a patched kernel version as provided by their Linux distribution (Feedly).