CVE-2023-54117: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54117 is a Linux kernel vulnerability in the s390/dcssblk driver that can cause a kernel crash due to list_add corruption. The flaw was introduced by commit fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk association"), which required drivers to explicitly call dax_add_host() and dax_remove_host(), but the dcssblk driver was missing several dax_remove_host() calls. The vulnerability affects Linux kernel versions starting from the introduction of commit fb08a1908cb1 through fixed versions 6.1.53, 6.4.16, 6.5.3, and 6.6. It was published on December 24, 2025, and has no CVSS base score assigned at this time (Feedly, EUVD).

The root cause is improper resource management (CWE-459: Incomplete Cleanup) in the s390/dcssblk block driver. Missing dax_remove_host() calls during device removal left stale entries in the xarray data structure. When blk_alloc_disk() subsequently returned a previously used struct gendisk pointer, xa_insert() in dax_add_host() would fail and trigger an error path that performed an extra put_device() without a preceding get_device(). Combined with flawed error handling in device_register() cleanup within dcssblk, this caused a missing device_del() / klist_del(), ultimately resulting in a kernel crash via list_add corruption on a subsequent device_add() / klist_add() call (Feedly). The fix adds the missing dax_remove_host() calls and corrects the put_device() placement in the error path (Kernel Patch 1, Kernel Patch 2).

Successful triggering of this vulnerability results in a kernel crash (denial of service) on affected s390 (IBM Z) systems using the dcssblk driver. The crash occurs due to kernel list corruption, which can render the system unavailable and require a reboot. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise, and exploitation requires local access to perform device add/remove cycles on the affected driver (Feedly).

Apply the upstream kernel patches that add the missing dax_remove_host() calls and correct the put_device() error path logic. Fixed versions include Linux kernel 6.1.53, 6.4.16, 6.5.3, and 6.6. Administrators running s390 (IBM Z) systems should update to a patched kernel version as soon as possible. If immediate patching is not feasible, avoiding repeated add/remove cycles of dcssblk devices may reduce the risk of triggering the crash (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3, Kernel Patch 4).