CVE-2023-54294

What it actually does

Memory leak of md thread object in raid10_run() error path when setup_conf() succeeds but mddev->thread assignment is not reached before failure return.

Why it matters to the business

Repeated configuration errors on software RAID10 arrays can slowly exhaust kernel memory, leading to degraded performance or crashes on Linux systems using md RAID.

How an attack unfolds

An attacker with local access triggers the specific error path in raid10 array setup repeatedly to cause unbounded allocation of md thread structures that are never freed.

How to fix it

Update the Linux kernel to a version containing commit abf4d67060c8f63caff096e5fca1564bfef1e5d4 which moves mddev->thread assignment immediately after setup_conf().

How to confirm the fix worked

Verify presence of the fix commit in the running kernel source or confirm kernel package version includes the corrected raid10.c logic; test by forcing the original error path and checking for thread leaks.

Typical attack path

1. Obtain local access to a Linux system using md RAID10
2. Issue repeated mdadm or equivalent operations that cause raid10_run() to succeed in setup_conf() but fail afterward
3. Repeat to accumulate leaked md thread allocations until memory pressure occurs

How to detect it

Inspect kernel logs for raid10_run error paths combined with increasing slab or kmalloc usage attributed to md thread objects; monitor /proc/meminfo and slabinfo for growth after failed array operations.

What your security team should do

• Apply the referenced kernel commit or distribution update as soon as possible on all systems using md RAID10
• Review kernel logs for raid10 initialization failures and correlate with memory growth
• Limit unprivileged local access where feasible until patched