{"id":"DEBIAN-CVE-2023-54023","details":"In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix race between balance and cancel/pause  Syzbot reported a panic that looks like this:    assertion failed: fs_info-\u003eexclusive_operation == BTRFS_EXCLOP_BALANCE_PAUSED, in fs/btrfs/ioctl.c:465   ------------[ cut here ]------------   kernel BUG at fs/btrfs/messages.c:259!   RIP: 0010:btrfs_assertfail+0x2c/0x30 fs/btrfs/messages.c:259   Call Trace:    \u003cTASK\u003e    btrfs_exclop_balance fs/btrfs/ioctl.c:465 [inline]    btrfs_ioctl_balance fs/btrfs/ioctl.c:3564 [inline]    btrfs_ioctl+0x531e/0x5b30 fs/btrfs/ioctl.c:4632    vfs_ioctl fs/ioctl.c:51 [inline]    __do_sys_ioctl fs/ioctl.c:870 [inline]    __se_sys_ioctl fs/ioctl.c:856 [inline]    __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856    do_syscall_x64 arch/x86/entry/common.c:50 [inline]    do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80    entry_SYSCALL_64_after_hwframe+0x63/0xcd  The reproducer is running a balance and a cancel or pause in parallel. The way balance finishes is a bit wonky, if we were paused we need to save the balance_ctl in the fs_info, but clear it otherwise and cleanup. However we rely on the return values being specific errors, or having a cancel request or no pause request.  If balance completes and returns 0, but we have a pause or cancel request we won't do the appropriate cleanup, and then the next time we try to start a balance we'll trip this ASSERT.  The error handling is just wrong here, we always want to clean up, unless we got -ECANCELLED and we set the appropriate pause flag in the exclusive op.  With this patch the reproducer ran for an hour without tripping, previously it would trip in less than a few minutes.","modified":"2026-09-15T08:47:33.677191995Z","published":"2025-12-24T11:15:55.307Z","upstream":["CVE-2023-54023"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-54023"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.52-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54023.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54023.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-54023.json"}}],"schema_version":"1.9.0"}