PT-2025-37888 · Kvm+3 · Kvm+3

Published 2025-09-16 · Updated 2025-09-16 · CVE-2023-53283

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a vulnerability in the xen/virtio subsystem where a NULL dereference can occur within the xen dt get node() function when a bridge of the PCI root bus has no parent. This occurs when running Xen on a QEMU/KVM virtual machine with virtio devices (all x86 64 architectures). The issue arises because the PCI root bus is created from ACPI description without a parent, leading to a NULL pointer access when attempting to access bus->bridge->parent->of node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2023-53283

Affected Products

Kvm

Linux Kernel

Qemu

Xen

References · 3

• https://git.kernel.org/stable/c/9c1c1cc08b880752947f52c3e18cebb46e0d9c51 · Note
• https://git.kernel.org/stable/c/21a235bce12361e64adfc2ef97e4ae2e51ad63d4 · Note
• https://t.me/CVEtracker/32592 · Telegram Post