CVE-2023-54099
kernel: fs: Protect reconfiguration of sb read-write from racing writes
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · December 24, 2025
Updated · June 30, 2026
Description
A race condition was found in the Linux kernel's filesystem remount code. When remounting a filesystem from read-only to read-write, the SB_RDONLY flag is cleared before the filesystem is fully prepared to accept writes. This allows userspace writes to race with filesystem initialization operations like quota file preparation, potentially causing filesystem corruption or crashes.
Statement
This flaw was discovered by syzbot and affects filesystems like ext4 that perform internal writes during remount read-write. The race window exists between clearing SB_RDONLY and completing filesystem-specific initialization. Exploiting this requires timing userspace writes precisely during remount operations.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition