CVE-2023-54128

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-54128", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T13:02:52.521Z", "datePublished": "2025-12-24T13:06:46.056Z", "dateUpdated": "2026-10-15T21:41:40.328Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:28.737Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: drop peer group ids under namespace lock\n\nWhen cleaning up peer group ids in the failure path we need to make sure\nto hold on to the namespace lock. Otherwise another thread might just\nturn the mount from a shared into a non-shared mount concurrently."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the mount_setattr(2) syscall from a local process, with the racing side driven by concurrent umount(2)/mount propagation-change syscalls. No network path exists to fs/namespace.c mount-propagation code.\nAC:L - The attacker controls both sides of the race \u2014 one thread deterministically forces the error path (mnt_hold_writers() -EBUSY on a write-open fd, or -EPERM on the MNT_LOCK_* mounts a userns unshare always yields) while another thread umounts a submount or flips a peer from shared to private, and the unlocked O(n) tree walk is widened arbitrarily by pre-building a large mount tree.\nPR:L - mount_setattr() gates on may_mount() = ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN), which any unprivileged local user satisfies via unshare(CLONE_NEWUSER|CLONE_NEWNS); check_mnt() then confines operations to that attacker-owned namespace. No real root is required.\nUI:N - The attacker performs every step itself \u2014 creating the mount tree, issuing the failing mount_setattr() and the racing umount/propagation change. No victim action is needed.\nS:U - The corruption is confined to kernel VFS structures and is exploited by the same kernel security authority that manages them; this is standard in-kernel privilege escalation rather than a hypervisor or IOMMU boundary crossing.\nC:H - The unlocked walk reads mnt_mounts/mnt_child/mnt_parent from freed mnt_cache objects (use-after-free read), and premature peer-group-ID release plus ID reuse makes peers() true across unrelated groups so propagate_mnt() can expose mounts and their file contents in namespaces that must not see them.\nI:H - mnt_release_group_id() writes mnt_group_id = 0 into a freed and potentially reallocated struct mount, and the corrupted peer-group identity drives propagate_one() into wrong CL_MAKE_SHARED/CL_SLAVE decisions that attach mounts into trees they should never reach \u2014 a use-after-free write plus attacker-influenced mount-namespace state corruption.\nA:H - A concurrent umount's list_del_init(&mnt->mnt_child) makes next_mnt() return the same node, sending cleanup_group_ids() into an unkillable infinite loop with no cond_resched() (soft/hard lockup); the double ida_free() also hits WARN() which panics under panic_on_warn, and peer-group confusion yields a NULL deref in propagate_one()."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/namespace.c"], "versions": [{"version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "lessThan": "0af8fae81d8b7f1beddc17c5d4cfa43235134648", "status": "affected", "versionType": "git"}, {"version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "lessThan": "ddca03d97daa7b07b60c52e3d3060762732c6666", "status": "affected", "versionType": "git"}, {"version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "lessThan": "65c324d3f35c05e37afec39ac80743583fdcc96c", "status": "affected", "versionType": "git"}, {"version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "lessThan": "cb2239c198ad9fbd5aced22cf93e45562da781eb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/namespace.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.107", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.24", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.2.11", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.15.107"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0af8fae81d8b7f1beddc17c5d4cfa43235134648"}, {"url": "https://git.kernel.org/stable/c/ddca03d97daa7b07b60c52e3d3060762732c6666"}, {"url": "https://git.kernel.org/stable/c/65c324d3f35c05e37afec39ac80743583fdcc96c"}, {"url": "https://git.kernel.org/stable/c/cb2239c198ad9fbd5aced22cf93e45562da781eb"}], "title": "fs: drop peer group ids under namespace lock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54128", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:38:42.661717Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:40.328Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54128", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:38:42.661717Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:38:43.504Z"}}], "cna": {"title": "fs: drop peer group ids under namespace lock", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the mount_setattr(2) syscall from a local process, with the racing side driven by concurrent umount(2)/mount propagation-change syscalls. No network path exists to fs/namespace.c mount-propagation code.\nAC:L - The attacker controls both sides of the race \u2014 one thread deterministically forces the error path (mnt_hold_writers() -EBUSY on a write-open fd, or -EPERM on the MNT_LOCK_* mounts a userns unshare always yields) while another thread umounts a submount or flips a peer from shared to private, and the unlocked O(n) tree walk is widened arbitrarily by pre-building a large mount tree.\nPR:L - mount_setattr() gates on may_mount() = ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN), which any unprivileged local user satisfies via unshare(CLONE_NEWUSER|CLONE_NEWNS); check_mnt() then confines operations to that attacker-owned namespace. No real root is required.\nUI:N - The attacker performs every step itself \u2014 creating the mount tree, issuing the failing mount_setattr() and the racing umount/propagation change. No victim action is needed.\nS:U - The corruption is confined to kernel VFS structures and is exploited by the same kernel security authority that manages them; this is standard in-kernel privilege escalation rather than a hypervisor or IOMMU boundary crossing.\nC:H - The unlocked walk reads mnt_mounts/mnt_child/mnt_parent from freed mnt_cache objects (use-after-free read), and premature peer-group-ID release plus ID reuse makes peers() true across unrelated groups so propagate_mnt() can expose mounts and their file contents in namespaces that must not see them.\nI:H - mnt_release_group_id() writes mnt_group_id = 0 into a freed and potentially reallocated struct mount, and the corrupted peer-group identity drives propagate_one() into wrong CL_MAKE_SHARED/CL_SLAVE decisions that attach mounts into trees they should never reach \u2014 a use-after-free write plus attacker-influenced mount-namespace state corruption.\nA:H - A concurrent umount's list_del_init(&mnt->mnt_child) makes next_mnt() return the same node, sending cleanup_group_ids() into an unkillable infinite loop with no cond_resched() (soft/hard lockup); the double ida_free() also hits WARN() which panics under panic_on_warn, and peer-group confusion yields a NULL deref in propagate_one()."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "lessThan": "0af8fae81d8b7f1beddc17c5d4cfa43235134648", "versionType": "git"}, {"status": "affected", "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "lessThan": "ddca03d97daa7b07b60c52e3d3060762732c6666", "versionType": "git"}, {"status": "affected", "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "lessThan": "65c324d3f35c05e37afec39ac80743583fdcc96c", "versionType": "git"}, {"status": "affected", "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "lessThan": "cb2239c198ad9fbd5aced22cf93e45562da781eb", "versionType": "git"}], "programFiles": ["fs/namespace.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"status": "unaffected", "version": "0", "lessThan": "5.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.107", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.24", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.2.11", "versionType": "semver", "lessThanOrEqual": "6.2.*"}, {"status": "unaffected", "version": "6.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/namespace.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0af8fae81d8b7f1beddc17c5d4cfa43235134648"}, {"url": "https://git.kernel.org/stable/c/ddca03d97daa7b07b60c52e3d3060762732c6666"}, {"url": "https://git.kernel.org/stable/c/65c324d3f35c05e37afec39ac80743583fdcc96c"}, {"url": "https://git.kernel.org/stable/c/cb2239c198ad9fbd5aced22cf93e45562da781eb"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: drop peer group ids under namespace lock\n\nWhen cleaning up peer group ids in the failure path we need to make sure\nto hold on to the namespace lock. Otherwise another thread might just\nturn the mount from a shared into a non-shared mount concurrently."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.107", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.24", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.2.11", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.3", "versionStartIncluding": "5.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:28.737Z"}}}, "cveMetadata": {"cveId": "CVE-2023-54128", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:40.328Z", "dateReserved": "2025-12-24T13:02:52.521Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-24T13:06:46.056Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/namespace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0af8fae81d8b7f1beddc17c5d4cfa43235134648", "status": "affected", "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "versionType": "git"}, {"lessThan": "ddca03d97daa7b07b60c52e3d3060762732c6666", "status": "affected", "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "versionType": "git"}, {"lessThan": "65c324d3f35c05e37afec39ac80743583fdcc96c", "status": "affected", "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "versionType": "git"}, {"lessThan": "cb2239c198ad9fbd5aced22cf93e45562da781eb", "status": "affected", "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/namespace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.107", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.24", "versionType": "semver"}, {"lessThanOrEqual": "6.2.*", "status": "unaffected", "version": "6.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: drop peer group ids under namespace lock\n\nWhen cleaning up peer group ids in the failure path we need to make sure\nto hold on to the namespace lock. Otherwise another thread might just\nturn the mount from a shared into a non-shared mount concurrently."}], "id": "CVE-2023-54128", "lastModified": "2026-10-15T22:17:53.643", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-54128", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:38:42.661717Z", "version": "2.0.3"}}]}, "published": "2025-12-24T13:16:14.787", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0af8fae81d8b7f1beddc17c5d4cfa43235134648"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/65c324d3f35c05e37afec39ac80743583fdcc96c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cb2239c198ad9fbd5aced22cf93e45562da781eb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ddca03d97daa7b07b60c52e3d3060762732c6666"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: fs: drop peer group ids under namespace lock", "id": "2425104", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425104"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2023-54128", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-54128\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-54128\nhttps://lore.kernel.org/linux-cve-announce/2025122419-CVE-2023-54128-a164@gregkh/T"], "threat_severity": "Low"}

{}