CVE-2023-54019

A use-after-free vulnerability was found in the Linux kernel's PSI (Pressure Stall Information) trigger handling for cgroups. When a cgroup is removed while a process is polling its PSI trigger file, the trigger's waitqueue is destroyed via psi_trigger_destroy() while the polling process still holds a reference. The subsequent poll_freewait() accesses the freed waitqueue head, causing a use-after-free crash.

This flaw affects systems using cgroup PSI monitoring with poll() or select() on PSI trigger files. The race occurs when a cgroup is removed (rmdir) while another process is actively polling for PSI events on that cgroup. This is a lifecycle mismatch between the PSI trigger and the associated file descriptor. A previous fix addressed epoll() but left synchronous poll() vulnerable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.