CVE-2023-54324: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54324 is a race condition vulnerability in the Linux kernel's device mapper (DM) multipath subsystem, specifically in the retrieve_deps function. The flaw arises when retrieve_deps races with multipath_message calling dm_get_device and dm_put_device, potentially resulting in memory corruption or use-after-free (UAF) memory access. It affects Linux kernel versions from the initial commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) up to the patched releases in stable branches. The vulnerability was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.017% (Feedly, EUVD).

The root cause is a classic time-of-check/time-of-use (TOCTOU) race condition (CWE-362) combined with a use-after-free (CWE-416) in the Linux kernel's DM multipath target. retrieve_deps iterates over the list of open devices without holding any lock, while concurrently multipath_message can invoke dm_get_device or dm_put_device to add or remove devices from that same list. This unsynchronized concurrent access can lead to the iterator referencing freed memory. The fix introduces a new read-write semaphore devices_lock: retrieve_deps acquires it for reading, while dm_get_device and dm_put_device acquire it for writing, eliminating the race (Feedly, Red Hat DM-devel).

Successful exploitation of this vulnerability can result in memory corruption or use-after-free conditions within the Linux kernel, potentially leading to a kernel panic (denial of service) or, in more severe scenarios, privilege escalation by a local attacker who can trigger the race condition. The vulnerability is confined to systems using the DM multipath target, which is common in enterprise storage environments. Exploitation requires local access and the ability to send multipath messages while dependency retrieval is in progress (Feedly).

The fix has been backported to stable Linux kernel branches: version 6.1.56, 6.5.5, and 6.6. Users should update to these or later kernel versions to remediate the vulnerability (EUVD). The relevant patches are available at the upstream kernel stable repository commits dbf1a719850577bb51fc7512a3972994b797a17b, 38f6e5ae5d9ff4a4050ea6f7b543d5d5a4e087cf, and f6007dce0cd35d634d9be91ef3515a6385dcee16. As a temporary workaround where patching is not immediately possible, restricting local user access to multipath management interfaces (e.g., limiting multipathd and dmsetup privileges) can reduce exposure.