CVE-2023-54281: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54281 is a denial-of-service vulnerability in the Linux kernel's Btrfs filesystem subsystem, specifically in the handling of the inode number (ino) lookup ioctl. The flaw causes a potential deadlock when btrfs_iget() is called while a path in the root's B-tree is already held, leading to a circular locking dependency. It affects the Linux kernel and was publicly disclosed on December 30, 2025. The CVSS v3.1 base score is 5.5 (Medium), reflecting a local attack vector with low privileges required and high availability impact (Red Hat Bugzilla, Red Hat CVE).

The root cause is improper lock ordering in the Btrfs btrfs_ioctl_ino_lookup_user() function (CWE-667: Improper Locking). During the ino lookup ioctl, btrfs_search_path_in_tree_user() calls btrfs_iget_path() while still holding a read lock on the root's B-tree path. If the inode is not cached in memory, btrfs_iget() triggers btrfs_lookup_inode(), which attempts to acquire another lock on the same or a dependent B-tree node, creating a circular locking dependency (AB-BA deadlock). This was confirmed via a lockdep splat on kernel 6.5.0-rc7, showing the dependency chain between btrfs-tree-00 and btrfs-tree-01 locks. The fix requires releasing the held path before invoking the inode lookup (Red Hat Bugzilla).

Successful exploitation results in a kernel deadlock, causing a denial of service — the affected system or filesystem operations may hang indefinitely, requiring a reboot to recover. There is no confidentiality or integrity impact; only availability is affected (rated High). A local user with low privileges who can invoke the Btrfs ino lookup ioctl (e.g., BTRFS_IOC_INO_LOOKUP_USER) on a mounted Btrfs filesystem can trigger this condition (Red Hat Bugzilla, Red Hat CVE).

The fix involves releasing the Btrfs path before calling btrfs_iget() during the ino lookup ioctl, and patches have been committed to the Linux kernel stable tree (commits 6fdce81e, 50e385d9, 380bbd46, 7390bb37). Users should update to a patched kernel version that includes these fixes. Red Hat has tracked this issue in Bugzilla (Bug 2426255) and the patch status is confirmed. As a workaround, restricting unprivileged access to Btrfs ioctls or avoiding the use of Btrfs filesystems on sensitive systems can reduce exposure until a patched kernel is applied (Red Hat Bugzilla).