bcache: fixup btree_cache_wait list damage

{
  "id": "9918e90e87493cfb6740a7ef11f2507ae1cb798a404739999aed9657abcdef18",
  "url": "https://osv.dev/vulnerability/CVE-2023-54293",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "bcache: fixup btree_cache_wait list damage",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: bcache: fixup btree_cache_wait list damage We get a kernel crash about \"list_add corruption. next->prev should be prev (ffff9c801bc01210), but was ffff9c77b688237c. (next=ffffae586d8afe68).\" crash> struct list_head 0xffff9c801bc01210 struct list_head { next = 0xffffae586d8afe68, prev = 0xffffae586d8afe68 } crash> struct list_head 0xffff9c77b688237c struct list_head { next = 0x0, prev = 0x0 } crash> struct list_head 0xffffae586d8afe68 struct list_head struct: invalid kernel virtual address: ffffae586d8afe68 type: \"gdb_readmem_callback\" Cannot access memory at address 0xffffae586d8afe68 [230469.019492] Call Trace: [230469.032041] prepare_to_wait+0x8a/0xb0 [230469.044363] ? bch_btree_keys_free+0x6c/0xc0 [escache] [230469.056533] mca_cannibalize_lock+0x72/0x90 [escache] [230469.068788] mca_alloc+0x2ae/0x450 [escache] [230469.080790] bch_btree_node_get+0x136/0x2d0 [escache] [230469.092681] bch_btree_check_thread+0x1e1/0x260 [escache] [230469.104382] ? finish_wait+0x80/0x80 [230469.115884] ? bch_btree_check_recurse+0x1a0/0x1a0 [escache] [230469.127259] kthread+0x112/0x130 [230469.138448] ? kthread_flush_work_fn+0x10/0x10 [230469.149477] ret_from_fork+0x35/0x40 bch_btree_check_thread() and bch_dirty_init_thread() may call mca_cannibalize() to cannibalize other cached btree nodes. Only one thread can do it at a time, so the op of other threads will be added to the btree_cache_wait list. We must call finish_wait() to ",
    "evidence": "osv:CVE-2023-54293",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.188",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.121",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.39",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.4.4",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2023-54293",
      "aliases": [
        "CVE-2023-54293"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "8e7102273f597dbb38af43da874f8c123f8e6dbe"
                },
                {
                  "fixed": "bcb295778afda4f2feb0d3c0289a53fd43d5a3a6"
                },
                {
                  "fixed": "cbdd5b3322f7bbe6454c97cac994757f1192c07b"
                },
                {
                  "fixed": "25ec4779d0fb3ed9cac1e4d9e0e4261b4a12f6ed"
                },
                {
                  "fixed": "2882a4c4f0c90e99f37dbd8db369b9982fd613e7"
                },
                {
                  "fixed": "f0854489fc07d2456f7cc71a63f4faf9c716ffbe"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54293.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.7.0"
                },
                {
                  "fixed": "5.10.188"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.121"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.39"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.4.4"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54293.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:27.874482680Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/25ec4779d0fb3ed9cac1e4d9e0e4261b4a12f6ed",
        "https://git.kernel.org/stable/c/2882a4c4f0c90e99f37dbd8db369b9982fd613e7",
        "https://git.kernel.org/stable/c/bcb295778afda4f2feb0d3c0289a53fd43d5a3a6",
        "https://git.kernel.org/stable/c/cbdd5b3322f7bbe6454c97cac994757f1192c07b",
        "https://git.kernel.org/stable/c/f0854489fc07d2456f7cc71a63f4faf9c716ffbe",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54293.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-54293",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54293.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-54293",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 494507,
  "published_at": "2025-12-30T12:23:31.111+00:00"
}