{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54095", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T13:02:52.516Z", "datePublished": "2025-12-24T13:06:23.157Z", "dateUpdated": "2026-08-05T09:17:13.179Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:13.179Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: Fix notifiers being shared by PCI and VIO buses\n\nfail_iommu_setup() registers the fail_iommu_bus_notifier struct to both\nPCI and VIO buses. struct notifier_block is a linked list node, so this\ncauses any notifiers later registered to either bus type to also be\nregistered to the other since they share the same node.\n\nThis causes issues in (at least) the vgaarb code, which registers a\nnotifier for PCI buses. pci_notify() ends up being called on a vio\ndevice, converted with to_pci_dev() even though it's not a PCI device,\nand finally makes a bad access in vga_arbiter_add_pci_device() as\ndiscovered with KASAN:\n\n BUG: KASAN: slab-out-of-bounds in vga_arbiter_add_pci_device+0x60/0xe00\n Read of size 4 at addr c000000264c26fdc by task swapper/0/1\n\n Call Trace:\n dump_stack_lvl+0x1bc/0x2b8 (unreliable)\n print_report+0x3f4/0xc60\n kasan_report+0x244/0x698\n __asan_load4+0xe8/0x250\n vga_arbiter_add_pci_device+0x60/0xe00\n pci_notify+0x88/0x444\n notifier_call_chain+0x104/0x320\n blocking_notifier_call_chain+0xa0/0x140\n device_add+0xac8/0x1d30\n device_register+0x58/0x80\n vio_register_device_node+0x9ac/0xce0\n vio_bus_scan_register_devices+0xc4/0x13c\n __machine_initcall_pseries_vio_device_init+0x94/0xf0\n do_one_initcall+0x12c/0xaa8\n kernel_init_freeable+0xa48/0xba8\n kernel_init+0x64/0x400\n ret_from_kernel_thread+0x5c/0x64\n\nFix this by creating separate notifier_block structs for each bus type.\n\n[mpe: Add #ifdef to fix CONFIG_IBMVIO=n build]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The defect lives in powerpc arch code exercised by PCI/VIO bus device registration; it manifests during local device enumeration at boot or via locally-initiated DLPAR hotplug, with no network- or adjacent-facing input path.\nAC:H - Exploitation requires the rare non-default debug config CONFIG_FAIL_IOMMU (depends on CONFIG_FAULT_INJECTION, in no shipped defconfig) on a pseries system built with both PCI and IBMVIO, and the type-confusion outcome depends on whatever slab contents happen to precede the vio_dev allocation — heap layout an attacker cannot influence on the boot path.\nPR:L - On an affected build the corruption fires during normal device registration without any privilege, and the resulting bogus vga_device is published through the vga arbiter to ordinary local users; taking the higher-severity option, no more than basic unprivileged local access is assumed.\nUI:N - The faulty notifier chain is spliced by an arch_initcall and fires automatically when VIO devices are registered during boot; no victim action is needed.\nS:U - The bug is in sysfs notifier registration, not in IOMMU TCE/DMA-window translation, so no DMA or virtualization isolation boundary is crossed — impact stays within the kernel's own security authority.\nC:H - to_pci_dev() on a vio_dev is a type confusion producing KASAN-confirmed slab-out-of-bounds reads of kernel memory that is then interpreted as struct pci_dev fields and surfaced through vgaarb logging, the vga_list and boot_vga sysfs state.\nI:H - Type confusion is treated as high integrity impact: the confused pointer reaches an indirect call through pdev->bus->ops read from out-of-bounds memory, and the eeh_remove_device() path performs stores through the same wild pointer, giving write and control-flow corruption primitives.\nA:H - The reported failure is a KASAN slab-out-of-bounds during early boot device registration, and dereferencing a fabricated struct pci_dev readily oopses or panics the kernel, rendering an affected pseries LPAR unbootable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/powerpc/kernel/iommu.c" ], "versions": [ { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "lessThan": "dc0d107e624ca96aef6dd8722eb33ba3a6d157b0", "status": "affected", "versionType": "git" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "lessThan": "075a4dcdbc9a5ea793cb8ec8b78a6c0b7636fd52", "status": "affected", "versionType": "git" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "lessThan": "65bf8a196ba25cf65a858b5bb8de80f0aad76691", "status": "affected", "versionType": "git" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "lessThan": "f08944e3c6962b00827de7263a9e20688e79ad84", "status": "affected", "versionType": "git" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "lessThan": "a9ddbfed53465bc7c411231db32a488066c0c1be", "status": "affected", "versionType": "git" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "lessThan": "f17d5efaafba3d5f02f0373f7c5f44711d676f3e", "status": "affected", "versionType": "git" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "lessThan": "c46af58588253e5e4063bb5ddc78cd12fdf9e55d", "status": "affected", "versionType": "git" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "lessThan": "6670c65bf863cd0d44ca24d4c10ef6755b8d9529", "status": "affected", "versionType": "git" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "lessThan": "c37b6908f7b2bd24dcaaf14a180e28c9132b9c58", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/powerpc/kernel/iommu.c" ], "versions": [ { "version": "3.6", "status": "affected" }, { "version": "0", "lessThan": "3.6", "status": "unaffected", "versionType": "semver" }, { "version": "4.14.326", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.295", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.257", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.195", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.132", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.53", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4.16", "lessThanOrEqual": "6.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.5.3", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "4.14.326" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "4.19.295" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.4.257" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.10.195" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.15.132" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.1.53" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.4.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.5.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.6" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/dc0d107e624ca96aef6dd8722eb33ba3a6d157b0" }, { "url": "https://git.kernel.org/stable/c/075a4dcdbc9a5ea793cb8ec8b78a6c0b7636fd52" }, { "url": "https://git.kernel.org/stable/c/65bf8a196ba25cf65a858b5bb8de80f0aad76691" }, { "url": "https://git.kernel.org/stable/c/f08944e3c6962b00827de7263a9e20688e79ad84" }, { "url": "https://git.kernel.org/stable/c/a9ddbfed53465bc7c411231db32a488066c0c1be" }, { "url": "https://git.kernel.org/stable/c/f17d5efaafba3d5f02f0373f7c5f44711d676f3e" }, { "url": "https://git.kernel.org/stable/c/c46af58588253e5e4063bb5ddc78cd12fdf9e55d" }, { "url": "https://git.kernel.org/stable/c/6670c65bf863cd0d44ca24d4c10ef6755b8d9529" }, { "url": "https://git.kernel.org/stable/c/c37b6908f7b2bd24dcaaf14a180e28c9132b9c58" } ], "title": "powerpc/iommu: Fix notifiers being shared by PCI and VIO buses", "x_generator": { "engine": "bippy-1.2.0" } } } }