CVE-2023-54099: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54099 is a race condition vulnerability in the Linux kernel's filesystem reconfiguration code, specifically in the handling of remounting a read-only filesystem to read-write mode. When the SB_RDONLY flag is cleared during remount, userspace writes can begin immediately before the filesystem (e.g., ext4) has completed necessary initialization steps such as quota file preparation, creating a window for exploitation. The vulnerability was discovered via syzbot fuzzing and publicly disclosed on December 24, 2025. It affects the Linux kernel across multiple stable branches, with fixes backported to versions 5.4.253, 5.10.190, 5.15.126, 6.1.45, 6.4.10, and 6.5+. The CVSS category is estimated as Medium (Feedly).

The root cause is a time-of-check to time-of-use (TOCTOU) race condition (CWE-362) in the Linux kernel's VFS remount path. When a filesystem is remounted read-write, the kernel clears the SB_RDONLY superblock flag before completing all necessary filesystem-level initialization, allowing concurrent userspace write operations to race against the remount procedure. The fix introduces use of the sb->s_readonly_remount flag to block racing writes during the transition window, analogous to the protection previously provided by the mount's MNT_READONLY flag in the legacy mount path. The issue was originally identified by syzbot and reported via the kernel mailing list (Feedly, Kernel ML).

Successful exploitation of this race condition could allow a local user to perform unauthorized writes to a filesystem during the brief window when it is transitioning from read-only to read-write mode, before the filesystem has completed its initialization. This could result in filesystem corruption, data integrity violations, or exploitation of filesystem-specific logic (such as ext4 quota handling) in an inconsistent state. The impact is primarily on integrity and potentially availability of the affected filesystem, with limited confidentiality impact (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Users should upgrade to the following fixed versions or later: Linux 5.4.253, 5.10.190, 5.15.126, 6.1.45, 6.4.10, or 6.5+. The fix applies the sb->s_readonly_remount flag to serialize remount-to-read-write transitions against concurrent userspace writes, eliminating the race window. Linux distribution vendors (Red Hat, Ubuntu, SUSE, etc.) are expected to backport these fixes into their respective kernel packages; users should apply available distribution security updates promptly (Feedly).