CVE-2023-53823

What it actually does

Race condition in rq_qos APIs allows concurrent rq_qos_add, rq_qos_exit and blkcg_activate_policy calls during del_gendisk, causing null-ptr-dereference or memory leaks when iocost/iolatency policies are enabled via cgroupfs.

Why it matters to the business

Kernel crashes or memory leaks can occur on systems using block devices with I/O QoS or cgroup policies, increasing downtime risk for storage workloads; low urgency as not observed in ransomware or KEV campaigns and EPSS remains flat at 0.00183.

How an attack unfolds

An attacker with local access triggers concurrent disk removal (del_gendisk) and cgroup policy activation (blkg_conf_open_bdev + rq_qos_add) to hit the unprotected rq_qos state, resulting in a crash or leak; no named threat actors or public exploits known.

How to fix it

Upgrade affected Linux kernels to the fixed commit 16398b4638b5cd8c1dc95fc940a1591a801d53ce or later; for Ubuntu krb5 packages apply the listed updates (1.12+dfsg-2ubuntu5.4, 1.13.2+dfsg-5ubuntu2.1, 1.16-2ubuntu0.1).

How to confirm the fix worked

Verify kernel version contains commit 16398b4638b5 or inspect for presence of rq_qos_mutex in block/rq_qos.c; confirm disk_live() checks are present after blkg_conf_open_bdev.

Typical attack path

1. Obtain local code execution or shell on target
2. Enable iocost or iolatency via cgroupfs while triggering device removal
3. Cause rq_qos_exit to interleave with rq_qos_add or blkcg_activate_policy
4. Trigger null pointer dereference or memory leak in the block layer

How to detect it

Search kernel logs for null pointer dereference or oops messages referencing rq_qos_exit, blkcg_activate_policy or blkg_conf_open_bdev around the time of device removal or cgroup policy changes.

What your security team should do

• Prioritize kernel updates on storage and container hosts within 30 days
• Monitor for kernel oops involving rq_qos or blkcg during cgroup changes
• Disable unnecessary iocost/iolatency policies until patched if crashes observed