CVE-2023-54227

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-54227", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-30T12:06:44.502Z", "datePublished": "2025-12-30T12:11:20.207Z", "dateUpdated": "2026-10-15T21:41:42.461Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:55:05.417Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix tags leak when shrink nr_hw_queues\n\nAlthough we don't need to realloc set->tags[] when shrink nr_hw_queues,\nwe need to free them. Or these tags will be leaked.\n\nHow to reproduce:\n1. mount -t configfs configfs /mnt\n2. modprobe null_blk nr_devices=0 submit_queues=8\n3. mkdir /mnt/nullb/nullb0\n4. echo 1 > /mnt/nullb/nullb0/power\n5. echo 4 > /mnt/nullb/nullb0/submit_queues\n6. rmdir /mnt/nullb/nullb0\n\nIn step 4, will alloc 9 tags (8 submit queues and 1 poll queue), then\nin step 5, new_nr_hw_queues = 5 (4 submit queues and 1 poll queue).\nAt last in step 6, only these 5 tags are freed, the other 4 tags leaked."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The shrink is driven by remote-peer data on NVMe-oF hosts \u2014 `nvme_set_queue_count()` takes the I/O queue count verbatim from the target's Set Features completion and feeds it to `blk_mq_update_nr_hw_queues()` on every reconnect, with the tag set persisting across reconnects. A hostile/compromised target or on-path attacker on an unauthenticated NVMe/TCP fabric reaches the vulnerable code over the network.\nAC:L - The attacker fully controls the granted queue count in each Set Features response and can force reconnects at will by closing the transport connection, so each shrink\u2192grow cycle is triggered deterministically with no conditions outside the attacker's control.\nPR:N - The remote peer needs no credentials on the victim host; NVMe/TCP in the affected 5.16\u20136.5 range has no in-band authentication or TLS, and the queue-count negotiation happens automatically during controller reconnect.\nUI:N - Reconnect and queue renegotiation are fully automatic in the nvme fabrics keep-alive/reconnect path; no administrator or user action is needed at exploitation time.\nS:U - The leaked allocations and the resulting memory pressure are confined to the kernel of the affected host; no security authority boundary such as a VM or IOMMU domain is crossed.\nC:N - The leaked `blk_mq_tags` and request pages are simply never freed \u2014 they are not read, exposed, or transmitted anywhere, so no information is disclosed to the attacker.\nI:N - No out-of-bounds write, use-after-free, or type confusion occurs; the stale pointers are only dropped, leaving no primitive to modify kernel or user data.\nA:H - Because the regrow path memcpy's only the shrunken count and frees the old array, every shrink\u2192grow cycle permanently leaks a full per-queue request pool, making the leak unbounded and repeatable until kernel memory is exhausted and the system OOMs or hangs."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/blk-mq.c"], "versions": [{"version": "a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e", "lessThan": "26d495f0f64d8cd4fcd29206ee5c653ee0e0cbcd", "status": "affected", "versionType": "git"}, {"version": "a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e", "lessThan": "c0ef7493e68b8896806a2f598fcffbaa97333405", "status": "affected", "versionType": "git"}, {"version": "a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e", "lessThan": "e1dd7bc93029024af5688253b0c05181d6e01f8e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["block/blk-mq.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5.5", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.5.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/26d495f0f64d8cd4fcd29206ee5c653ee0e0cbcd"}, {"url": "https://git.kernel.org/stable/c/c0ef7493e68b8896806a2f598fcffbaa97333405"}, {"url": "https://git.kernel.org/stable/c/e1dd7bc93029024af5688253b0c05181d6e01f8e"}], "title": "blk-mq: fix tags leak when shrink nr_hw_queues", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54227", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:39:33.828518Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:42.461Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54227", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:39:33.828518Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:39:34.332Z"}}], "cna": {"title": "blk-mq: fix tags leak when shrink nr_hw_queues", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The shrink is driven by remote-peer data on NVMe-oF hosts \u2014 `nvme_set_queue_count()` takes the I/O queue count verbatim from the target's Set Features completion and feeds it to `blk_mq_update_nr_hw_queues()` on every reconnect, with the tag set persisting across reconnects. A hostile/compromised target or on-path attacker on an unauthenticated NVMe/TCP fabric reaches the vulnerable code over the network.\nAC:L - The attacker fully controls the granted queue count in each Set Features response and can force reconnects at will by closing the transport connection, so each shrink\u2192grow cycle is triggered deterministically with no conditions outside the attacker's control.\nPR:N - The remote peer needs no credentials on the victim host; NVMe/TCP in the affected 5.16\u20136.5 range has no in-band authentication or TLS, and the queue-count negotiation happens automatically during controller reconnect.\nUI:N - Reconnect and queue renegotiation are fully automatic in the nvme fabrics keep-alive/reconnect path; no administrator or user action is needed at exploitation time.\nS:U - The leaked allocations and the resulting memory pressure are confined to the kernel of the affected host; no security authority boundary such as a VM or IOMMU domain is crossed.\nC:N - The leaked `blk_mq_tags` and request pages are simply never freed \u2014 they are not read, exposed, or transmitted anywhere, so no information is disclosed to the attacker.\nI:N - No out-of-bounds write, use-after-free, or type confusion occurs; the stale pointers are only dropped, leaving no primitive to modify kernel or user data.\nA:H - Because the regrow path memcpy's only the shrunken count and frees the old array, every shrink\u2192grow cycle permanently leaks a full per-queue request pool, making the leak unbounded and repeatable until kernel memory is exhausted and the system OOMs or hangs."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e", "lessThan": "26d495f0f64d8cd4fcd29206ee5c653ee0e0cbcd", "versionType": "git"}, {"status": "affected", "version": "a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e", "lessThan": "c0ef7493e68b8896806a2f598fcffbaa97333405", "versionType": "git"}, {"status": "affected", "version": "a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e", "lessThan": "e1dd7bc93029024af5688253b0c05181d6e01f8e", "versionType": "git"}], "programFiles": ["block/blk-mq.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.189", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.5.5", "versionType": "semver", "lessThanOrEqual": "6.5.*"}, {"status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["block/blk-mq.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/26d495f0f64d8cd4fcd29206ee5c653ee0e0cbcd"}, {"url": "https://git.kernel.org/stable/c/c0ef7493e68b8896806a2f598fcffbaa97333405"}, {"url": "https://git.kernel.org/stable/c/e1dd7bc93029024af5688253b0c05181d6e01f8e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix tags leak when shrink nr_hw_queues\n\nAlthough we don't need to realloc set->tags[] when shrink nr_hw_queues,\nwe need to free them. Or these tags will be leaked.\n\nHow to reproduce:\n1. mount -t configfs configfs /mnt\n2. modprobe null_blk nr_devices=0 submit_queues=8\n3. mkdir /mnt/nullb/nullb0\n4. echo 1 > /mnt/nullb/nullb0/power\n5. echo 4 > /mnt/nullb/nullb0/submit_queues\n6. rmdir /mnt/nullb/nullb0\n\nIn step 4, will alloc 9 tags (8 submit queues and 1 poll queue), then\nin step 5, new_nr_hw_queues = 5 (4 submit queues and 1 poll queue).\nAt last in step 6, only these 5 tags are freed, the other 4 tags leaked."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.189", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.5.5", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6", "versionStartIncluding": "5.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:55:05.417Z"}}}, "cveMetadata": {"cveId": "CVE-2023-54227", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:42.461Z", "dateReserved": "2025-12-30T12:06:44.502Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-30T12:11:20.207Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["block/blk-mq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "26d495f0f64d8cd4fcd29206ee5c653ee0e0cbcd", "status": "affected", "version": "a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e", "versionType": "git"}, {"lessThan": "c0ef7493e68b8896806a2f598fcffbaa97333405", "status": "affected", "version": "a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e", "versionType": "git"}, {"lessThan": "e1dd7bc93029024af5688253b0c05181d6e01f8e", "status": "affected", "version": "a846a8e6c9a5949582c5a6a8bbc83a7d27fd891e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["block/blk-mq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.5.*", "status": "unaffected", "version": "6.5.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix tags leak when shrink nr_hw_queues\n\nAlthough we don't need to realloc set->tags[] when shrink nr_hw_queues,\nwe need to free them. Or these tags will be leaked.\n\nHow to reproduce:\n1. mount -t configfs configfs /mnt\n2. modprobe null_blk nr_devices=0 submit_queues=8\n3. mkdir /mnt/nullb/nullb0\n4. echo 1 > /mnt/nullb/nullb0/power\n5. echo 4 > /mnt/nullb/nullb0/submit_queues\n6. rmdir /mnt/nullb/nullb0\n\nIn step 4, will alloc 9 tags (8 submit queues and 1 poll queue), then\nin step 5, new_nr_hw_queues = 5 (4 submit queues and 1 poll queue).\nAt last in step 6, only these 5 tags are freed, the other 4 tags leaked."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nblk-mq: corrige la fuga de etiquetas al reducir nr_hw_queues\n\nAunque no necesitamos reasignar set -> tags[] al reducir nr_hw_queues, necesitamos liberarlas. O estas etiquetas se fugar\u00e1n.\n\nC\u00f3mo reproducir:\n1. mount -t configfs configfs /mnt\n2. modprobe null_blk nr_devices=0 submit_queues=8\n3. mkdir /mnt/nullb/nullb0\n4. echo 1 > /mnt/nullb/nullb0/power\n5. echo 4 > /mnt/nullb/nullb0/submit_queues\n6. rmdir /mnt/nullb/nullb0\n\nEn el paso 4, se asignar\u00e1n 9 etiquetas (8 colas de env\u00edo y 1 cola de sondeo), luego en el paso 5, new_nr_hw_queues = 5 (4 colas de env\u00edo y 1 cola de sondeo).\nFinalmente en el paso 6, solo estas 5 etiquetas son liberadas, las otras 4 etiquetas se fugaron."}], "id": "CVE-2023-54227", "lastModified": "2026-10-28T19:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-54227", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:39:33.828518Z", "version": "2.0.3"}}]}, "published": "2025-12-30T13:16:11.093", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/26d495f0f64d8cd4fcd29206ee5c653ee0e0cbcd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c0ef7493e68b8896806a2f598fcffbaa97333405"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e1dd7bc93029024af5688253b0c05181d6e01f8e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: blk-mq: fix tags leak when shrink nr_hw_queues", "id": "2426105", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426105"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2023-54227", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-54227\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-54227\nhttps://lore.kernel.org/linux-cve-announce/2025123029-CVE-2023-54227-5c6c@gregkh/T"], "threat_severity": "Low"}

{}