PT-2025-52959 · Btrfs+2 · Btrfs+2

Published 2025-12-24 · Updated 2026-04-20 · CVE-2023-54002

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the btrfs subsystem related to the assertion of exclusive operation conditions during balance operations. Specifically, the issue arises when multiple devices are concurrently added to the same mount point, potentially leading to assertion failures in btrfs exclop balance and btrfs ioctl add dev. This can occur when threads race to start balance and device add operations. The assertion failures are observed when the exclusive operation state is either BTRFS EXCLOP NONE or BTRFS EXCLOP BALANCE PAUSED. The issue manifests as failures when adding devices, as demonstrated in the provided example output. The fs info->exclusive operation variable is involved in the assertion checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-54002

Affected Products

Debian

Linux Kernel

Btrfs

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54002.json · Exploit
• https://ubuntu.com/security/CVE-2023-54002 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-54002 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-54002 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-54002 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2023-54002 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-54002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-54002 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-54002 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-54002 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/2004666674146877649 · Twitter Post
• https://git.kernel.org/stable/c/ac868bc9d136cde6e3eb5de77019a63d57a540ff · Note
• https://git.kernel.org/stable/c/17eaeee4c5f24946aad0298d51f32981c3161d13 · Note
• https://docs.bell-sw.com/security/cves/CVE-2023-54002 · Note