{"id":"CVE-2023-53823","state":"PUBLISHED","title":"block/rq_qos: protect rq_qos apis with a new lock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock/rq_qos: protect rq_qos apis with a new lock\n\ncommit 50e34d78815e (\"block: disable the elevator int del_gendisk\")\nmove rq_qos_exit() from disk_release() to del_gendisk(), this will\nintroduce some problems:\n\n1) If rq_qos_add() is triggered by enabling iocost/iolatency through\n   cgroupfs, then it can concurrent with del_gendisk(), it's not safe to\n   write 'q->rq_qos' concurrently.\n\n2) Activate cgroup policy that is relied on rq_qos will call\n   rq_qos_add() and blkcg_activate_policy(), and if rq_qos_exit() is\n   called in the middle, null-ptr-dereference will be triggered in\n   blkcg_activate_policy().\n\n3) blkg_conf_open_bdev() can call blkdev_get_no_open() first to find the\n   disk, then if rq_qos_exit() from del_gendisk() is done before\n   rq_qos_add(), then memory will be leaked.\n\nThis patch add a new disk level mutex 'rq_qos_mutex':\n\n1) The lock will protect rq_qos_exit() directly.\n\n2) For wbt that doesn't relied on blk-cgroup, rq_qos_add() can only be\n   called from disk initialization for now because wbt can't be\n   destructed until rq_qos_exit(), so it's safe not to protect wbt for\n   now. Hoever, in case that rq_qos dynamically destruction is supported\n   in the furture, this patch also protect rq_qos_add() from wbt_init()\n   directly, this is enough because blk-sysfs already synchronize\n   writers with disk removal.\n\n3) For iocost and iolatency, in order to synchronize disk removal and\n   cgroup configuration, the lock is held after blkdev_get_no_open()\n   from blkg_conf_open_bdev(), and is released in blkg_conf_exit().\n   In order to fix the above memory leak, disk_live() is checked after\n   holding the new lock.","publishedAt":"2025-12-09T01:29:36.343Z","updatedAt":"2026-10-30T12:17:36.868Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"50e34d78815e474d410f342fbe783b18192ca518","status":"affected","lessThan":"f54c4ab8ffecf621ab20fb6d2b194af93616cd7e","versionType":"git"},{"version":"50e34d78815e474d410f342fbe783b18192ca518","status":"affected","lessThan":"16398b4638b5cd8c1dc95fc940a1591a801d53ce","versionType":"git"},{"version":"50e34d78815e474d410f342fbe783b18192ca518","status":"affected","lessThan":"a13bd91be22318768d55470cbc0b0f4488ef9edf","versionType":"git"},{"version":"f28699fafc047ec33299da01e928c3a0073c5cc6","status":"affected","versionType":"git"},{"version":"5.18.8","status":"affected","lessThan":"5.19","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/blk-cgroup.c","block/blk-core.c","block/blk-rq-qos.c","block/blk-wbt.c","include/linux/blkdev.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.4.4","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/blk-cgroup.c","block/blk-core.c","block/blk-rq-qos.c","block/blk-wbt.c","include/linux/blkdev.h"]}],"references":["https://git.kernel.org/stable/c/f54c4ab8ffecf621ab20fb6d2b194af93616cd7e","https://git.kernel.org/stable/c/16398b4638b5cd8c1dc95fc940a1591a801d53ce","https://git.kernel.org/stable/c/a13bd91be22318768d55470cbc0b0f4488ef9edf"],"weaknesses":[],"ingestedAt":"2026-10-30T12:34:06.950Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/53xxx/CVE-2023-53823.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53823","state":"PUBLISHED","datePublished":"2025-12-09T01:29:36.343Z","dateUpdated":"2026-10-30T12:17:36.868Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-12-09T01:27:17.824Z"},"containers":{"cna":{"title":"block/rq_qos: protect rq_qos apis with a new lock","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock/rq_qos: protect rq_qos apis with a new lock\n\ncommit 50e34d78815e (\"block: disable the elevator int del_gendisk\")\nmove rq_qos_exit() from disk_release() to del_gendisk(), this will\nintroduce some problems:\n\n1) If rq_qos_add() is triggered by enabling iocost/iolatency through\n   cgroupfs, then it can concurrent with del_gendisk(), it's not safe to\n   write 'q->rq_qos' concurrently.\n\n2) Activate cgroup policy that is relied on rq_qos will call\n   rq_qos_add() and blkcg_activate_policy(), and if rq_qos_exit() is\n   called in the middle, null-ptr-dereference will be triggered in\n   blkcg_activate_policy().\n\n3) blkg_conf_open_bdev() can call blkdev_get_no_open() first to find the\n   disk, then if rq_qos_exit() from del_gendisk() is done before\n   rq_qos_add(), then memory will be leaked.\n\nThis patch add a new disk level mutex 'rq_qos_mutex':\n\n1) The lock will protect rq_qos_exit() directly.\n\n2) For wbt that doesn't relied on blk-cgroup, rq_qos_add() can only be\n   called from disk initialization for now because wbt can't be\n   destructed until rq_qos_exit(), so it's safe not to protect wbt for\n   now. Hoever, in case that rq_qos dynamically destruction is supported\n   in the furture, this patch also protect rq_qos_add() from wbt_init()\n   directly, this is enough because blk-sysfs already synchronize\n   writers with disk removal.\n\n3) For iocost and iolatency, in order to synchronize disk removal and\n   cgroup configuration, the lock is held after blkdev_get_no_open()\n   from blkg_conf_open_bdev(), and is released in blkg_conf_exit().\n   In order to fix the above memory leak, disk_live() is checked after\n   holding the new lock."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"50e34d78815e474d410f342fbe783b18192ca518","status":"affected","lessThan":"f54c4ab8ffecf621ab20fb6d2b194af93616cd7e","versionType":"git"},{"version":"50e34d78815e474d410f342fbe783b18192ca518","status":"affected","lessThan":"16398b4638b5cd8c1dc95fc940a1591a801d53ce","versionType":"git"},{"version":"50e34d78815e474d410f342fbe783b18192ca518","status":"affected","lessThan":"a13bd91be22318768d55470cbc0b0f4488ef9edf","versionType":"git"},{"version":"f28699fafc047ec33299da01e928c3a0073c5cc6","status":"affected","versionType":"git"},{"version":"5.18.8","status":"affected","lessThan":"5.19","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/blk-cgroup.c","block/blk-core.c","block/blk-rq-qos.c","block/blk-wbt.c","include/linux/blkdev.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.4.4","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/blk-cgroup.c","block/blk-core.c","block/blk-rq-qos.c","block/blk-wbt.c","include/linux/blkdev.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/f54c4ab8ffecf621ab20fb6d2b194af93616cd7e"},{"url":"https://git.kernel.org/stable/c/16398b4638b5cd8c1dc95fc940a1591a801d53ce"},{"url":"https://git.kernel.org/stable/c/a13bd91be22318768d55470cbc0b0f4488ef9edf"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Both sides of the race are driven through local interfaces — a cgroupfs write to `io.latency`/`io.cost.qos` reaching `rq_qos_add()`, and a block-device removal reaching `del_gendisk()`→`rq_qos_exit()`. There is no remote or network-facing path into the block rq_qos layer.\nAC:L - The attacker controls both sides: they can loop the `io.latency` write against any device by MAJ:MIN (no permission check in `blkg_conf_open_bdev()`) while triggering repeated disk teardown (loop/nbd device delete), and can stretch the `rq_qos_add()`→`timer_setup()` window arbitrarily by populating the queue with thousands of blkgs so `blkcg_activate_policy()` spends a long time in GFP_KERNEL allocation and retry.\nPR:L - No capability check exists on the path — `iolatency_set_limit()`/`blkg_conf_open_bdev()` gate only on cgroupfs file permissions, and `cgroup_add_file()` creates interface files owned by `current_fsuid()`, so an unprivileged user with a delegated cgroup v2 subtree (systemd delegation, container runtimes) can write `io.latency` and target any block device on the system.\nUI:N - The attacker performs both the cgroup configuration write and the disk removal themselves; no action by any other user or administrator is needed.\nS:U - The corruption is confined to kernel heap objects and the block layer's request_queue within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The unsynchronized `q->rq_qos` update leaves freed `rq_qos` objects linked in the chain and dangling `blk_iolatency`/gendisk pointers, giving a use-after-free read primitive over reclaimed slab memory that can be groomed to disclose arbitrary kernel data.\nI:H - `blk_iolatency_init()` continues writing (`timer_setup()`, `INIT_WORK()`) into the object already freed by `blkcg_iolatency_exit()`, and `__rq_qos_throttle()` performs an indirect call through `rqos->ops->throttle` read from freed memory — a heap-spray-controllable arbitrary write and control-flow hijack.\nA:H - The race reliably produces kernel oopses — a NULL dereference through `iolat->blkiolat` set to NULL by `iolatency_pd_init()`, plus use-after-free faults on the rq_qos chain during I/O submission and from the leaked object's timer firing after the disk is released."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:17:36.868Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.4.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18.8"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}