---
id: CVE-2023-53823
title: 'block/rq_qos: protect rq_qos apis with a new lock'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  block/rq_qos: protect rq_qos apis with a new lock

  commit 50e34d78815e ("block: disable the elevator int del_gendisk")
  move rq_qos_exit() from disk_release() to del_gen…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 50e34d78815e474d410f342fbe783b18192ca518 <
    f54c4ab8ffecf621ab20fb6d2b194af93616cd7e
  - >-
    Linux >= 50e34d78815e474d410f342fbe783b18192ca518 <
    16398b4638b5cd8c1dc95fc940a1591a801d53ce
  - >-
    Linux >= 50e34d78815e474d410f342fbe783b18192ca518 <
    a13bd91be22318768d55470cbc0b0f4488ef9edf
  - Linux f28699fafc047ec33299da01e928c3a0073c5cc6
  - Linux >= 5.18.8 < 5.19
  - Linux 5.19
published: '2025-12-09'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:17:36.868Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53823'
references:
  - url: 'https://git.kernel.org/stable/c/f54c4ab8ffecf621ab20fb6d2b194af93616cd7e'
  - url: 'https://git.kernel.org/stable/c/16398b4638b5cd8c1dc95fc940a1591a801d53ce'
  - url: 'https://git.kernel.org/stable/c/a13bd91be22318768d55470cbc0b0f4488ef9edf'
tags:
  - cve.org
epss: 0.00192
epssPercentile: 0.08912
ingestedAt: '2026-11-03T11:43:15.789Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

block/rq_qos: protect rq_qos apis with a new lock

commit 50e34d78815e ("block: disable the elevator int del_gendisk")
move rq_qos_exit() from disk_release() to del_gendisk(), this will
introduce some problems:

1) If rq_qos_add() is triggered by enabling iocost/iolatency through
   cgroupfs, then it can concurrent with del_gendisk(), it's not safe to
   write 'q->rq_qos' concurrently.

2) Activate cgroup policy that is relied on rq_qos will call
   rq_qos_add() and blkcg_activate_policy(), and if rq_qos_exit() is
   called in the middle, null-ptr-dereference will be triggered in
   blkcg_activate_policy().

3) blkg_conf_open_bdev() can call blkdev_get_no_open() first to find the
   disk, then if rq_qos_exit() from del_gendisk() is done before
   rq_qos_add(), then memory will be leaked.

This patch add a new disk level mutex 'rq_qos_mutex':

1) The lock will protect rq_qos_exit() directly.

2) For wbt that doesn't relied on blk-cgroup, rq_qos_add() can only be
   called from disk initialization for now because wbt can't be
   destructed until rq_qos_exit(), so it's safe not to protect wbt for
   now. Hoever, in case that rq_qos dynamically destruction is supported
   in the furture, this patch also protect rq_qos_add() from wbt_init()
   directly, this is enough because blk-sysfs already synchronize
   writers with disk removal.

3) For iocost and iolatency, in order to synchronize disk removal and
   cgroup configuration, the lock is held after blkdev_get_no_open()
   from blkg_conf_open_bdev(), and is released in blkg_conf_exit().
   In order to fix the above memory leak, disk_live() is checked after
   holding the new lock.

## Affected

- `Linux >= 50e34d78815e474d410f342fbe783b18192ca518 < f54c4ab8ffecf621ab20fb6d2b194af93616cd7e`
- `Linux >= 50e34d78815e474d410f342fbe783b18192ca518 < 16398b4638b5cd8c1dc95fc940a1591a801d53ce`
- `Linux >= 50e34d78815e474d410f342fbe783b18192ca518 < a13bd91be22318768d55470cbc0b0f4488ef9edf`
- `Linux f28699fafc047ec33299da01e928c3a0073c5cc6`
- `Linux >= 5.18.8 < 5.19`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.