https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 21:57:12 +0000 https://vulnerability.circl.lu/vuln/cve-2023-53810 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>blk-mq: release crypto keyslot before reporting I/O complete</p> <p>Once all I/O using a blk_crypto_key has completed, filesystems can call blk_crypto_evict_key(). However, the block layer currently doesn&#39;t call blk_crypto_put_keyslot() until the request is being freed, which happens after upper layers have been told (via bio_endio()) the I/O has completed. This causes a race condition where blk_crypto_evict_key() can see &#39;slot_refs != 0&#39; without there being an actual bug.</p> <p>This makes __blk_crypto_evict_key() hit the &#39;WARN_ON_ONCE(atomic_read(&amp;slot-&gt;slot_refs) != 0)&#39; and return without doing anything, eventually causing a use-after-free in blk_crypto_reprogram_all_keys(). (This is a very rare bug and has only been seen when per-file keys are being used with fscrypt.)</p> <p>There are two options to fix this: either release the keyslot before bio_endio() is called on the request&#39;s last bio, or make __blk_crypto_evict_key() ignore slot_refs. Let&#39;s go with the first solution, since it preserves the ability to report bugs (via WARN_ON_ONCE) where a key is evicted while still in-use.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>blk-mq: release crypto keyslot before reporting I/O complete</p> <p>Once all I/O using a blk_crypto_key has completed, filesystems can call blk_crypto_evict_key(). However, the block layer currently doesn&#39;t call blk_crypto_put_keyslot() until the request is being freed, which happens after upper layers have been told (via bio_endio()) the I/O has completed. This causes a race condition where blk_crypto_evict_key() can see &#39;slot_refs != 0&#39; without there being an actual bug.</p> <p>This makes __blk_crypto_evict_key() hit the &#39;WARN_ON_ONCE(atomic_read(&amp;slot-&gt;slot_refs) != 0)&#39; and return without doing anything, eventually causing a use-after-free in blk_crypto_reprogram_all_keys(). (This is a very rare bug and has only been seen when per-file keys are being used with fscrypt.)</p> <p>There are two options to fix this: either release the keyslot before bio_endio() is called on the request&#39;s last bio, or make __blk_crypto_evict_key() ignore slot_refs. Let&#39;s go with the first solution, since it preserves the ability to report bugs (via WARN_ON_ONCE) where a key is evicted while still in-use.</p> https://vulnerability.circl.lu/vuln/cve-2023-53810