GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54117 (GCVE-0-2023-54117)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:06 – Updated: 2026-05-11 19:55
VLAI
Title
s390/dcssblk: fix kernel crash with list_add corruption
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/dcssblk: fix kernel crash with list_add corruption Commit fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk association") introduced new logic for gendisk association, requiring drivers to explicitly call dax_add_host() and dax_remove_host(). For dcssblk driver, some dax_remove_host() calls were missing, e.g. in device remove path. The commit also broke error handling for out_dax case in device add path, resulting in an extra put_device() w/o the previous get_device() in that case. This lead to stale xarray entries after device add / remove cycles. In the case when a previously used struct gendisk pointer (xarray index) would be used again, because blk_alloc_disk() happened to return such a pointer, the xa_insert() in dax_add_host() would fail and go to out_dax, doing the extra put_device() in the error path. In combination with an already flawed error handling in dcssblk (device_register() cleanup), which needs to be addressed in a separate patch, this resulted in a missing device_del() / klist_del(), and eventually in the kernel crash with list_add corruption on a subsequent device_add() / klist_add(). Fix this by adding the missing dax_remove_host() calls, and also move the put_device() in the error path to restore the previous logic.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fb08a1908cb119a4585611d91461ab6d27756b14 , < 6489ec0107860345bc57dcde39e63dfb05ac5c11 (git)
Affected: fb08a1908cb119a4585611d91461ab6d27756b14 , < b7ad75c77349beb4983b9f27108d9b3f33ae1413 (git)
Affected: fb08a1908cb119a4585611d91461ab6d27756b14 , < b5c531a9a7d8e047c90c909f09cef06a9f8e62f4 (git)
Affected: fb08a1908cb119a4585611d91461ab6d27756b14 , < c8f40a0bccefd613748d080147469a4652d6e74c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.53 , ≤ 6.1.* (semver)
Unaffected: 6.4.16 , ≤ 6.4.* (semver)
Unaffected: 6.5.3 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/block/dcssblk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6489ec0107860345bc57dcde39e63dfb05ac5c11",
              "status": "affected",
              "version": "fb08a1908cb119a4585611d91461ab6d27756b14",
              "versionType": "git"
            },
            {
              "lessThan": "b7ad75c77349beb4983b9f27108d9b3f33ae1413",
              "status": "affected",
              "version": "fb08a1908cb119a4585611d91461ab6d27756b14",
              "versionType": "git"
            },
            {
              "lessThan": "b5c531a9a7d8e047c90c909f09cef06a9f8e62f4",
              "status": "affected",
              "version": "fb08a1908cb119a4585611d91461ab6d27756b14",
              "versionType": "git"
            },
            {
              "lessThan": "c8f40a0bccefd613748d080147469a4652d6e74c",
              "status": "affected",
              "version": "fb08a1908cb119a4585611d91461ab6d27756b14",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/block/dcssblk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.53",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.16",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.3",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dcssblk: fix kernel crash with list_add corruption\n\nCommit fb08a1908cb1 (\"dax: simplify the dax_device \u003c-\u003e gendisk\nassociation\") introduced new logic for gendisk association, requiring\ndrivers to explicitly call dax_add_host() and dax_remove_host().\n\nFor dcssblk driver, some dax_remove_host() calls were missing, e.g. in\ndevice remove path. The commit also broke error handling for out_dax case\nin device add path, resulting in an extra put_device() w/o the previous\nget_device() in that case.\n\nThis lead to stale xarray entries after device add / remove cycles. In the\ncase when a previously used struct gendisk pointer (xarray index) would be\nused again, because blk_alloc_disk() happened to return such a pointer, the\nxa_insert() in dax_add_host() would fail and go to out_dax, doing the extra\nput_device() in the error path. In combination with an already flawed error\nhandling in dcssblk (device_register() cleanup), which needs to be\naddressed in a separate patch, this resulted in a missing device_del() /\nklist_del(), and eventually in the kernel crash with list_add corruption on\na subsequent device_add() / klist_add().\n\nFix this by adding the missing dax_remove_host() calls, and also move the\nput_device() in the error path to restore the previous logic."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:55:48.438Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6489ec0107860345bc57dcde39e63dfb05ac5c11"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7ad75c77349beb4983b9f27108d9b3f33ae1413"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5c531a9a7d8e047c90c909f09cef06a9f8e62f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8f40a0bccefd613748d080147469a4652d6e74c"
        }
      ],
      "title": "s390/dcssblk: fix kernel crash with list_add corruption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54117",
    "datePublished": "2025-12-24T13:06:38.311Z",
    "dateReserved": "2025-12-24T13:02:52.520Z",
    "dateUpdated": "2026-05-11T19:55:48.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54117",
      "date": "2026-09-16",
      "epss": "0.00204",
      "percentile": "0.10537"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54117\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:13.637\",\"lastModified\":\"2026-06-17T06:46:49.960\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/dcssblk: fix kernel crash with list_add corruption\\n\\nCommit fb08a1908cb1 (\\\"dax: simplify the dax_device \u003c-\u003e gendisk\\nassociation\\\") introduced new logic for gendisk association, requiring\\ndrivers to explicitly call dax_add_host() and dax_remove_host().\\n\\nFor dcssblk driver, some dax_remove_host() calls were missing, e.g. in\\ndevice remove path. The commit also broke error handling for out_dax case\\nin device add path, resulting in an extra put_device() w/o the previous\\nget_device() in that case.\\n\\nThis lead to stale xarray entries after device add / remove cycles. In the\\ncase when a previously used struct gendisk pointer (xarray index) would be\\nused again, because blk_alloc_disk() happened to return such a pointer, the\\nxa_insert() in dax_add_host() would fail and go to out_dax, doing the extra\\nput_device() in the error path. In combination with an already flawed error\\nhandling in dcssblk (device_register() cleanup), which needs to be\\naddressed in a separate patch, this resulted in a missing device_del() /\\nklist_del(), and eventually in the kernel crash with list_add corruption on\\na subsequent device_add() / klist_add().\\n\\nFix this by adding the missing dax_remove_host() calls, and also move the\\nput_device() in the error path to restore the previous logic.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/s390/block/dcssblk.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fb08a1908cb119a4585611d91461ab6d27756b14\",\"lessThan\":\"6489ec0107860345bc57dcde39e63dfb05ac5c11\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb08a1908cb119a4585611d91461ab6d27756b14\",\"lessThan\":\"b7ad75c77349beb4983b9f27108d9b3f33ae1413\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb08a1908cb119a4585611d91461ab6d27756b14\",\"lessThan\":\"b5c531a9a7d8e047c90c909f09cef06a9f8e62f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb08a1908cb119a4585611d91461ab6d27756b14\",\"lessThan\":\"c8f40a0bccefd613748d080147469a4652d6e74c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/s390/block/dcssblk.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.53\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.16\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5.3\",\"lessThanOrEqual\":\"6.5.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6489ec0107860345bc57dcde39e63dfb05ac5c11\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b5c531a9a7d8e047c90c909f09cef06a9f8e62f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b7ad75c77349beb4983b9f27108d9b3f33ae1413\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c8f40a0bccefd613748d080147469a4652d6e74c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:18:52+00:00",
      "cve": "CVE-2023-54117",
      "id": "CVE-2023-54117",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: s390/dcssblk: fix kernel crash with list_add corruption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54117.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:29:15Z",
      "cve": "CVE-2023-54117",
      "id": "CVE-2023-54117",
      "initial_release_date": "2025-12-25T00:55:14Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "457",
      "product_status:recommended": "255",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54117",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54117.json",
      "version": "36"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.