CVE-2023-53681

What it actually does

NULL pointer dereference in __bch_btree_node_alloc when allocation fails, allowing a caller such as btree_split via bch_btree_node_alloc to dereference the NULL return value and trigger a kernel panic.

Why it matters to the business

Local denial-of-service conditions on Linux systems that use the bcache subsystem, requiring reboots and potentially disrupting storage workloads until the kernel is updated.

How an attack unfolds

An attacker with local access triggers bcache btree split operations under memory pressure that cause __bch_btree_node_alloc to return NULL; the unhandled NULL propagates through bch_btree_node_alloc into btree_split and dereferences, crashing the kernel.

How to fix it

Update the Linux kernel to the commit 587b4e8bb5dac682f09280ab35db4632b29d5ac4 or later stable release containing the fix that initializes the return value in __bch_btree_node_alloc.

How to confirm the fix worked

Verify the running kernel contains commit 587b4e8bb5dac682f09280ab35db4632b29d5ac4; reproduce bcache allocation failure paths in a test environment and confirm no NULL dereference occurs.

Typical attack path

1. Obtain local user access on a system running an affected Linux kernel with bcache enabled
2. Create or mount a bcache-backed device and induce repeated btree split conditions
3. Force memory pressure that causes __bch_btree_node_alloc to fail and return NULL
4. Trigger the btree_split path that passes the NULL to a dereference site
5. Cause kernel panic or oops resulting in denial of service

How to detect it

Search kernel logs and dmesg for oops or panic traces containing btree_split, bch_btree_node_alloc, or __bch_btree_node_alloc around the time of unexpected reboots; correlate with bcache device activity.

• btree_split->bch_btree_node_alloc->__bch_btree_node_alloc
• NULL pointer dereference in bch_btree_node_alloc
• kernel BUG at drivers/md/bcache/btree.c

What your security team should do

• Apply the kernel update containing commit 587b4e8bb5dac682f09280ab35db4632b29d5ac4 on all systems using bcache
• Prioritize patching production storage servers before development or test systems
• Monitor for bcache-related kernel oops or panics in system logs until patches are deployed