CVE-2023-54209

block: fix blktrace debugfs entries leakage

N/A
Published: December 30, 2025 at 12:11 PM UTC
Updated: October 28, 2026 at 07:10 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: block: fix blktrace debugfs entries leakage Commit 99d055b4fd4b ("block: remove per-disk debugfs files in blk_unregister_queue") moves blk_trace_shutdown() from blk_release_queue() to blk_unregister_queue(), this is safe if blktrace is created through sysfs, however, there is a regression in corner case. blktrace can still be enabled after del_gendisk() through ioctl if the disk is opened before del_gendisk(), and if blktrace is not shutdown through ioctl before closing the disk, debugfs entries will be leaked. Fix this problem by shutdown blktrace in disk_release(), this is safe because blk_trace_remove() is reentrant.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.1999d055b4fd4bbb309c6cdb51a0d420669f777944
Vendor states this is fixed in 7149e57cf01184fba175589f8fbe9fbf33be02e1 (fixed)
Vendor states this is fixed in 942e81650b81b4ca62f1d8c61de455c9e7c7e6ca (fixed)
Vendor states this is fixed in aa07e56c6a9c7558165690d14eed4fe8babf34fb (fixed)
Vendor states this is fixed in dd7de3704af9989b780693d51eaea49a665bd9c2 (fixed)
Vendor states this is fixed in 5.19 (unaffected)
Vendor states this is fixed in 6.1.39 (unaffected)
Vendor states this is fixed in 6.3.13 (unaffected)
Vendor states this is fixed in 6.4.4 (unaffected)
Vendor states this is fixed in 6.5 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card