---
id: CVE-2023-54227
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  blk-mq: fix tags leak when shrink nr_hw_queues

  Although we don't need to realloc set->tags[] when shrink nr_hw_queues,
  we need to free them
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  blk-mq: fix tags leak when shrink nr_hw_queues

  Although we don't need to realloc set->tags[] when shrink nr_hw_queues,
  we need to free them. Or these tags will be leak…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e <
    26d495f0f64d8cd4fcd29206ee5c653ee0e0cbcd
  - >-
    Linux >= a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e <
    c0ef7493e68b8896806a2f598fcffbaa97333405
  - >-
    Linux >= a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e <
    e1dd7bc93029024af5688253b0c05181d6e01f8e
  - Linux 5.16
published: '2025-12-30'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:17:29.567'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-54227'
references:
  - url: 'https://git.kernel.org/stable/c/26d495f0f64d8cd4fcd29206ee5c653ee0e0cbcd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c0ef7493e68b8896806a2f598fcffbaa97333405'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e1dd7bc93029024af5688253b0c05181d6e01f8e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00412
epssPercentile: 0.33118
ingestedAt: '2026-10-03T11:43:42.113Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: fix tags leak when shrink nr_hw_queues

Although we don't need to realloc set->tags[] when shrink nr_hw_queues,
we need to free them. Or these tags will be leaked.

How to reproduce:
1. mount -t configfs configfs /mnt
2. modprobe null_blk nr_devices=0 submit_queues=8
3. mkdir /mnt/nullb/nullb0
4. echo 1 > /mnt/nullb/nullb0/power
5. echo 4 > /mnt/nullb/nullb0/submit_queues
6. rmdir /mnt/nullb/nullb0

In step 4, will alloc 9 tags (8 submit queues and 1 poll queue), then
in step 5, new_nr_hw_queues = 5 (4 submit queues and 1 poll queue).
At last in step 6, only these 5 tags are freed, the other 4 tags leaked.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.