CVE-2023-54324

A use-after-free flaw was found in the Linux kernel's device-mapper multipath implementation. A race condition exists between retrieve_deps() and multipath_message() when devices are added or removed. The retrieve_deps() function walks the device list without holding a lock while multipath_message() can modify the list, leading to use-after-free or memory corruption.

This affects systems using device-mapper multipath. The race requires concurrent multipath configuration changes while querying device dependencies. The use-after-free could potentially lead to kernel crashes or memory corruption, though exploitation for privilege escalation would be difficult.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.