PT-2025-49486 · Linux+1 · Linux Kernel+1

Published 2025-12-08 · Updated 2025-12-10 · CVE-2023-53756

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the KVM component, specifically related to nested hypervisor operation on Hyper-V. The issue stems from an uninitialized current vmcs variable within the evmcs touch msr bitmap function, leading to a potential crash when updating the MSR bitmap. This occurs because the code may incorrectly write to memory pointed to by an uninitialized current vmcs value, particularly during preemption scenarios. The root cause is the insufficient check for current vmcs being null. The issue is triggered by calls to vmx disable intercept for msr and vmx vcpu create. The crash manifests as a kernel NULL pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-53756

RHSA-2023:3465

RHSA-2023:6583

Affected Products

Hyper-V

Linux Kernel

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53756.json · Exploit
• https://ubuntu.com/security/CVE-2023-53756 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53756 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2023-53756 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-53756 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-53756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53756 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53756 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53756 · Vendor Advisory
• https://git.kernel.org/stable/c/6baebcecf09acd19e2bab1c2911dcdba5d48a1dc · Note
• https://docs.bell-sw.com/security/cves/CVE-2023-53756 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/stable/c/b2de2b4d4e007f9add46ea8dc06f781835e3ea9f · Note
• https://lore.kernel.org/linux-cve-announce/2025120843-CVE-2023-53756-f234@gregkh/T · Note
• https://git.kernel.org/linus/93827a0a36396f2fd6368a54a020f420c8916e9b · Note