Cloudanix VulnDB

CVE-2023-53765

None

CVSS

—

EPSS

0.2%

Published

Dec 8, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux storage caching code can cause the system to crash when certain disk cache devices are removed, fixed by installing newer kernel updates.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Incomplete cleanup in dm-cache's background tracker leaves queued work objects in the bt_work slab cache during btracker_destroy, triggering BUG and WARNING on kmem_cache_destroy when the cache policy is torn down.

Why it matters to the business

System crashes or kernel warnings during LVM device removal or cache policy destruction on affected Ubuntu kernels, disrupting storage management operations and potentially requiring reboots in environments using dm-cache.

How an attack unfolds

A local process issues device-mapper ioctls to remove a cached device (via lvm or dmsetup), causing smq_destroy to call btracker_destroy without draining queued work; the resulting slab leakage is exposed during module unload or shutdown, leading to the observed BUG.

How to fix it

Upgrade to the listed fixed package versions for each affected Ubuntu release (e.g., linux 5.13.0-19.19 on 22.04, linux-aws-5.15 5.15.0-1014.18~20.04.1 on 20.04, etc.). Reboot after installation to load corrected modules.

How to confirm the fix worked

Verify installed kernel package version matches or exceeds the fixed version for the distribution release; confirm absence of bt_work slab warnings on cache policy destruction via dmesg or journalctl.

Typical attack path

  1. Identify or create a dm-cache device on an affected kernel
  2. Trigger device removal via LVM or dmsetup remove
  3. btracker_destroy is called with pending work items
  4. kmem_cache_destroy fails with objects remaining, producing slab BUG/WARNING

How to detect it

Search kernel logs (dmesg, journalctl) for 'BUG bt_work', 'Objects remaining in bt_work', 'kmem_cache_destroy bt_work', or the call trace containing btracker_destroy and dm_cache during device removal operations.

  • BUG bt_work (Tainted
  • Objects remaining in bt_work on __kmem_cache_shutdown
  • kmem_cache_destroy bt_work: Slab cache still has objects
  • btracker_destroy+0x12/0x20 [dm_cache]

What your security team should do

  • Apply the exact fixed kernel packages immediately on all systems using dm-cache or LVM caching
  • Prioritize systems running LVM cache setups given the direct trigger path
  • Schedule reboots within the change window after package installation
  • Monitor for any remaining bt_work slab warnings post-upgrade

The record

In the Linux kernel, the following vulnerability has been resolved: dm cache: free background tracker's queued work in btracker_destroy Otherwise the kernel can BUG with: [ 2245.426978] ============================================================================= [ 2245.435155] BUG bt_work (Tainted: G B W ): Objects remaining in bt_work on __kmem_cache_shutdown() [ 2245.445233] ----------------------------------------------------------------------------- [ 2245.445233] [ 2245.454879] Slab 0x00000000b0ce2b30 objects=64 used=2 fp=0x000000000a3c6a4e flags=0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 2245.467300] CPU: 7 PID: 10805 Comm: lvm Kdump: loaded Tainted: G B W 6.0.0-rc2 #19 [ 2245.476078] Hardware name: Dell Inc. PowerEdge R7525/0590KW, BIOS 2.5.6 10/06/2021 [ 2245.483646] Call Trace: [ 2245.486100] <TASK> [ 2245.488206] dump_stack_lvl+0x34/0x48 [ 2245.491878] slab_err+0x95/0xcd [ 2245.495028] __kmem_cache_shutdown.cold+0x31/0x136 [ 2245.499821] kmem_cache_destroy+0x49/0x130 [ 2245.503928] btracker_destroy+0x12/0x20 [dm_cache] [ 2245.508728] smq_destroy+0x15/0x60 [dm_cache_smq] [ 2245.513435] dm_cache_policy_destroy+0x12/0x20 [dm_cache] [ 2245.518834] destroy+0xc0/0x110 [dm_cache] [ 2245.522933] dm_table_destroy+0x5c/0x120 [dm_mod] [ 2245.527649] __dm_destroy+0x10e/0x1c0 [dm_mod] [ 2245.532102] dev_remove+0x117/0x190 [dm_mod] [ 2245.536384] ctl_ioctl+0x1a2/0x290 [dm_mod] [ 2245.540579] dm_ctl_ioctl+0xa/0x20 [dm_mod] [ 2245.544773] __x64_sys_ioctl+0x8a/0xc0 [ 2245.548524] do_syscall_64+0x5c/0x90 [ 2245.552104] ? syscall_exit_to_user_mode+0x12/0x30 [ 2245.556897] ? do_syscall_64+0x69/0x90 [ 2245.560648] ? do_syscall_64+0x69/0x90 [ 2245.564394] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 2245.569447] RIP: 0033:0x7fe52583ec6b ... [ 2245.646771] ------------[ cut here ]------------ [ 2245.651395] kmem_cache_destroy bt_work: Slab cache still has objects when called from btracker_destroy+0x12/0x20 [dm_cache] [ 2245.651408] WARNING: CPU: 7 PID: 10805 at mm/slab_common.c:478 kmem_cache_destroy+0x128/0x130 Found using: lvm2-testsuite --only "cache-single-split.sh" Ben bisected and found that commit 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock") first exposed dm-cache's incomplete cleanup of its background tracker work objects.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 6.1.16
Linux Kernel 4.12.0 6.1.16

Related vulnerabilities