CVE-2023-53055

In the Linux kernel, the following vulnerability has been resolved:

fscrypt: destroy keyring after security_sb_delete()

fscrypt_destroy_keyring() must be called after all potentially-encrypted inodes were evicted; otherwise it cannot safely destroy the keyring. Since inodes that are in-use by the Landlock LSM don't get evicted until security_sb_delete(), this means that fscrypt_destroy_keyring() must be called after security_sb_delete().

This fixes a WARN_ON followed by a NULL dereference, only possible if Landlock was being used on encrypted files.

A logic bug in the unmount sequence could lead to a NULL pointer dereference when encrypted inodes are used in conjunction with the Landlock Linux Security Module (LSM). Specifically, fscrypt_destroy_keyring() was being called before security_sb_delete(), while inodes could still be referenced due to Landlock rules. This patch defers keyring destruction until after all security hooks have completed, ensuring that no encrypted inodes remain.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.