GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54128 (GCVE-0-2023-54128)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:06 – Updated: 2026-08-05 09:17
VLAI
Title
fs: drop peer group ids under namespace lock
Summary
In the Linux kernel, the following vulnerability has been resolved: fs: drop peer group ids under namespace lock When cleaning up peer group ids in the failure path we need to make sure to hold on to the namespace lock. Otherwise another thread might just turn the mount from a shared into a non-shared mount concurrently.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2a1867219c7b27f928e2545782b86daaf9ad50bd , < 0af8fae81d8b7f1beddc17c5d4cfa43235134648 (git)
Affected: 2a1867219c7b27f928e2545782b86daaf9ad50bd , < ddca03d97daa7b07b60c52e3d3060762732c6666 (git)
Affected: 2a1867219c7b27f928e2545782b86daaf9ad50bd , < 65c324d3f35c05e37afec39ac80743583fdcc96c (git)
Affected: 2a1867219c7b27f928e2545782b86daaf9ad50bd , < cb2239c198ad9fbd5aced22cf93e45562da781eb (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.107 , ≤ 5.15.* (semver)
Unaffected: 6.1.24 , ≤ 6.1.* (semver)
Unaffected: 6.2.11 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0af8fae81d8b7f1beddc17c5d4cfa43235134648",
              "status": "affected",
              "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd",
              "versionType": "git"
            },
            {
              "lessThan": "ddca03d97daa7b07b60c52e3d3060762732c6666",
              "status": "affected",
              "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd",
              "versionType": "git"
            },
            {
              "lessThan": "65c324d3f35c05e37afec39ac80743583fdcc96c",
              "status": "affected",
              "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd",
              "versionType": "git"
            },
            {
              "lessThan": "cb2239c198ad9fbd5aced22cf93e45562da781eb",
              "status": "affected",
              "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.107",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.24",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.11",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: drop peer group ids under namespace lock\n\nWhen cleaning up peer group ids in the failure path we need to make sure\nto hold on to the namespace lock. Otherwise another thread might just\nturn the mount from a shared into a non-shared mount concurrently."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the mount_setattr(2) syscall from a local process, with the racing side driven by concurrent umount(2)/mount propagation-change syscalls. No network path exists to fs/namespace.c mount-propagation code.\nAC:L - The attacker controls both sides of the race \u2014 one thread deterministically forces the error path (mnt_hold_writers() -EBUSY on a write-open fd, or -EPERM on the MNT_LOCK_* mounts a userns unshare always yields) while another thread umounts a submount or flips a peer from shared to private, and the unlocked O(n) tree walk is widened arbitrarily by pre-building a large mount tree.\nPR:L - mount_setattr() gates on may_mount() = ns_capable(current-\u003ensproxy-\u003emnt_ns-\u003euser_ns, CAP_SYS_ADMIN), which any unprivileged local user satisfies via unshare(CLONE_NEWUSER|CLONE_NEWNS); check_mnt() then confines operations to that attacker-owned namespace. No real root is required.\nUI:N - The attacker performs every step itself \u2014 creating the mount tree, issuing the failing mount_setattr() and the racing umount/propagation change. No victim action is needed.\nS:U - The corruption is confined to kernel VFS structures and is exploited by the same kernel security authority that manages them; this is standard in-kernel privilege escalation rather than a hypervisor or IOMMU boundary crossing.\nC:H - The unlocked walk reads mnt_mounts/mnt_child/mnt_parent from freed mnt_cache objects (use-after-free read), and premature peer-group-ID release plus ID reuse makes peers() true across unrelated groups so propagate_mnt() can expose mounts and their file contents in namespaces that must not see them.\nI:H - mnt_release_group_id() writes mnt_group_id = 0 into a freed and potentially reallocated struct mount, and the corrupted peer-group identity drives propagate_one() into wrong CL_MAKE_SHARED/CL_SLAVE decisions that attach mounts into trees they should never reach \u2014 a use-after-free write plus attacker-influenced mount-namespace state corruption.\nA:H - A concurrent umount\u0027s list_del_init(\u0026mnt-\u003emnt_child) makes next_mnt() return the same node, sending cleanup_group_ids() into an unkillable infinite loop with no cond_resched() (soft/hard lockup); the double ida_free() also hits WARN() which panics under panic_on_warn, and peer-group confusion yields a NULL deref in propagate_one()."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:28.737Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0af8fae81d8b7f1beddc17c5d4cfa43235134648"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddca03d97daa7b07b60c52e3d3060762732c6666"
        },
        {
          "url": "https://git.kernel.org/stable/c/65c324d3f35c05e37afec39ac80743583fdcc96c"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb2239c198ad9fbd5aced22cf93e45562da781eb"
        }
      ],
      "title": "fs: drop peer group ids under namespace lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54128",
    "datePublished": "2025-12-24T13:06:46.056Z",
    "dateReserved": "2025-12-24T13:02:52.521Z",
    "dateUpdated": "2026-08-05T09:17:28.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54128",
      "date": "2026-09-19",
      "epss": "0.00164",
      "percentile": "0.06057"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/namespace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0af8fae81d8b7f1beddc17c5d4cfa43235134648",
                    "status": "affected",
                    "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ddca03d97daa7b07b60c52e3d3060762732c6666",
                    "status": "affected",
                    "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "65c324d3f35c05e37afec39ac80743583fdcc96c",
                    "status": "affected",
                    "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cb2239c198ad9fbd5aced22cf93e45562da781eb",
                    "status": "affected",
                    "version": "2a1867219c7b27f928e2545782b86daaf9ad50bd",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/namespace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.12"
                  },
                  {
                    "lessThan": "5.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.107",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.24",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: drop peer group ids under namespace lock\n\nWhen cleaning up peer group ids in the failure path we need to make sure\nto hold on to the namespace lock. Otherwise another thread might just\nturn the mount from a shared into a non-shared mount concurrently."
          }
        ],
        "id": "CVE-2023-54128",
        "lastModified": "2026-08-04T10:19:30.513",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-24T13:16:14.787",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0af8fae81d8b7f1beddc17c5d4cfa43235134648"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/65c324d3f35c05e37afec39ac80743583fdcc96c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cb2239c198ad9fbd5aced22cf93e45562da781eb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ddca03d97daa7b07b60c52e3d3060762732c6666"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:53:25+00:00",
      "cve": "CVE-2023-54128",
      "id": "CVE-2023-54128",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "122",
      "product_status:known_not_affected": "152",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs: drop peer group ids under namespace lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54128.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.