CVE-2023-54067
NoneCVSS
—
EPSS
0.2%
Published
Dec 24, 2025
CISA due date
—
Cloudanix analysis
A flaw in Linux storage handling can cause computers to crash unexpectedly when certain disk operations happen at the same time.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Unsynchronized removal of a free space root from fs_info->dirty_cowonly_roots without holding btrfs_fs_info::trans_lock allows concurrent list modifications via add_root_to_dirty_list, resulting in use-after-free, list corruption, and kernel crashes such as general protection faults during commit_cowonly_roots.
Why it matters to the business
Linux systems using the btrfs filesystem may experience unexpected kernel crashes and service interruptions during balance or transaction commit operations, increasing operational downtime and potential data integrity risks in storage-heavy environments.
How an attack unfolds
An attacker with local access triggers concurrent btrfs operations that manipulate the dirty cowonly roots list, such as initiating a balance while free space tree deletion occurs, racing against trans_lock-protected additions and causing the kernel to dereference corrupted list pointers.
How to fix it
Upgrade to linux kernel versions containing commit 6f1c81886b0b56cb88b311e5d2f203625474d892 or Debian packages 6.0.6-1 and later; rebuild and reboot systems using affected btrfs modules.
How to confirm the fix worked
Verify kernel version is at or above the fixed release, confirm presence of the locking change around dirty_cowonly_roots deletion in source, and test btrfs balance and free space operations under load for stability.
Typical attack path
- Obtain local unprivileged access on a btrfs-formatted Linux system
- Issue btrfs balance or filesystem operations that add roots to the dirty list
- Trigger free space tree deletion concurrently without holding trans_lock
- Induce list corruption leading to crash in commit_cowonly_roots during transaction commit
How to detect it
Review kernel logs for general protection faults referencing commit_cowonly_roots or btrfs_balance; inspect for concurrent btrfs ioctl and transaction activity around crash timestamps.
What your security team should do
- Prioritize patching btrfs-using systems to the listed fixed versions within standard maintenance windows
- Monitor for btrfs-related kernel oops or general protection faults in system logs
- Restrict unprivileged local access to btrfs filesystems until patches are applied
The record
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race when deleting free space root from the dirty cow roots list When deleting the free space tree we are deleting the free space root from the list fs_info->dirty_cowonly_roots without taking the lock that protects it, which is struct btrfs_fs_info::trans_lock. This unsynchronized list manipulation may cause chaos if there's another concurrent manipulation of this list, such as when adding a root to it with ctree.c:add_root_to_dirty_list(). This can result in all sorts of weird failures caused by a race, such as the following crash: [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs] [337571.279928] Code: 85 38 06 00 (...) [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206 [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000 [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070 [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600 [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48 [337571.281723] FS: 00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000 [337571.281950] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0 [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [337571.282874] Call Trace: [337571.283101] <TASK> [337571.283327] ? __die_body+0x1b/0x60 [337571.283570] ? die_addr+0x39/0x60 [337571.283796] ? exc_general_protection+0x22e/0x430 [337571.284022] ? asm_exc_general_protection+0x22/0x30 [337571.284251] ? commit_cowonly_roots+0x11f/0x250 [btrfs] [337571.284531] btrfs_commit_transaction+0x42e/0xf90 [btrfs] [337571.284803] ? _raw_spin_unlock+0x15/0x30 [337571.285031] ? release_extent_buffer+0x103/0x130 [btrfs] [337571.285305] reset_balance_state+0x152/0x1b0 [btrfs] [337571.285578] btrfs_balance+0xa50/0x11e0 [btrfs] [337571.285864] ? __kmem_cache_alloc_node+0x14a/0x410 [337571.286086] btrfs_ioctl+0x249a/0x3320 [btrfs] [337571.286358] ? mod_objcg_state+0xd2/0x360 [337571.286577] ? refill_obj_stock+0xb0/0x160 [337571.286798] ? seq_release+0x25/0x30 [337571.287016] ? __rseq_handle_notify_resume+0x3ba/0x4b0 [337571.287235] ? percpu_counter_add_batch+0x2e/0xa0 [337571.287455] ? __x64_sys_ioctl+0x88/0xc0 [337571.287675] __x64_sys_ioctl+0x88/0xc0 [337571.287901] do_syscall_64+0x38/0x90 [337571.288126] entry_SYSCALL_64_after_hwframe+0x72/0xdc [337571.288352] RIP: 0033:0x7f478aaffe9b So fix this by locking struct btrfs_fs_info::trans_lock before deleting the free space root from that list.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Linux | Kernel | 4.5.0 | 6.1.39 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_19 | 0 | 1-150600.13.3.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-64kb | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-default | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-default-base | 0 | 6.4.0-150600.23.84.1.150600.12.38.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-docs | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-obs-build | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-source | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-syms | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | kernel-zfcpdump | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.84.1.150600.12.38.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.84.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.84.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.84.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.84.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.84.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.84.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.84.1.150600.12.38.1 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.84.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.84.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.84.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.84.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.84.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.84.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.84.1 |
Related vulnerabilities
- CVE-2026-23226 In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock… Also affects Kernel
- CVE-2026-23225 In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Don't… Also affects Kernel
- CVE-2026-23230 In the Linux kernel, the following vulnerability has been resolved: smb: client: split… Also affects Kernel
- CVE-2026-23224 In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue… Also affects Kernel
- CVE-2026-23227 In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use… Also affects Kernel
- CVE-2026-23223 In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in… Also affects Kernel
- CVE-2026-23228 In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak… Also affects Kernel
- CVE-2026-23229 In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add… Also affects Kernel