---
id: CVE-2023-54107
title: 'blk-cgroup: dropping parent refcount after pd_free_fn() is done'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  blk-cgroup: dropping parent refcount after pd_free_fn() is done

  Some cgroup policies will access parent pd through child pd even
  after pd_offline_fn() is done. If pd_f…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d578c770c85233af592e54537f93f3831bde7e9a <
    c7241babf0855d8a6180cd1743ff0ec34de40b4e
  - Linux 5.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:38:32.237187Z'
published: '2025-12-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:41:39.921Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-54107'
references:
  - url: 'https://git.kernel.org/stable/c/c7241babf0855d8a6180cd1743ff0ec34de40b4e'
tags:
  - cve.org
epss: 0.00152
epssPercentile: 0.03896
ingestedAt: '2026-10-15T22:48:25.429Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: dropping parent refcount after pd_free_fn() is done

Some cgroup policies will access parent pd through child pd even
after pd_offline_fn() is done. If pd_free_fn() for parent is called
before child, then UAF can be triggered. Hence it's better to guarantee
the order of pd_free_fn().

Currently refcount of parent blkg is dropped in __blkg_release(), which
is before pd_free_fn() is called in blkg_free_work_fn() while
blkg_free_work_fn() is called asynchronously.

This patch make sure pd_free_fn() called from removing cgroup is ordered
by delaying dropping parent refcount after calling pd_free_fn() for
child.

BTW, pd_free_fn() will also be called from blkcg_deactivate_policy()
from deleting device, and following patches will guarantee the order.

## Affected

- `Linux >= d578c770c85233af592e54537f93f3831bde7e9a < c7241babf0855d8a6180cd1743ff0ec34de40b4e`
- `Linux 5.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.