CVE-2023-54107: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54107 is a use-after-free (UAF) vulnerability in the Linux kernel's block cgroup (blk-cgroup) subsystem caused by incorrect ordering of policy descriptor (pd) release operations. When a parent's pd_free_fn() is called before the child's, a UAF condition can be triggered because some cgroup policies access the parent pd through the child pd even after pd_offline_fn() completes. The vulnerability was publicly disclosed on December 24, 2025, and affects Linux kernel versions prior to the patch commit c7241babf085 (fixing versions up to 6.3). It carries a CVSS v3.1 base score of 5.5 (Medium), requiring local low-privileged access with no user interaction (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition in reference counting within the blk-cgroup subsystem (CWE-416: Use After Free). The parent blkg's refcount is dropped in __blkg_release() before pd_free_fn() is called in blkg_free_work_fn(), which executes asynchronously. If the parent's pd_free_fn() runs before the child's, a child cgroup policy that still references the parent pd will access freed memory. The fix delays dropping the parent refcount until after the child's pd_free_fn() has completed, ensuring correct ordering. Exploitation requires local access to a system with cgroup block I/O policies active (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation of this vulnerability by a local low-privileged attacker could cause a denial of service through kernel memory corruption or system crash. In more severe scenarios, the UAF condition could potentially be leveraged for arbitrary kernel code execution, though this is considered a more complex attack path. The vulnerability's impact is limited to availability (no confidentiality or integrity impact per CVSS scoring), and it does not affect systems where blk-cgroup policies are not in use (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is addressed by a kernel patch that delays dropping the parent blkg refcount until after the child's pd_free_fn() is called, available in commit c7241babf0855d8a6180cd1743ff0ec34de40b4e targeting kernel versions from 6.3 onward. Users should update to a patched Linux kernel version as provided by their distribution (e.g., Red Hat/Fedora via their respective errata). As a workaround, limiting local user access and restricting the use of blk-cgroup I/O policies can reduce the attack surface until a patch is applied (Red Hat Bugzilla, Red Hat Advisory).