PT-2025-49655 · Linux+1 · Linux Kernel+1

Published

2025-12-09

·

Updated

2026-03-24

·

CVE-2023-53795

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.0-rc1-syzkaller
Description The Linux kernel contained a flaw in the iommufd subsystem where IOMMUFD DESTROY incorrectly increased the reference count. This created a race condition when combined with iommufd object destroy user(), potentially leading to spurious failures. The issue stemmed from elevating the reference count without holding the destroy rwsem, violating the assumption that temporary reference count elevations are protected by this semaphore. The resolution involves removing the reference count increment on the IOMMUFD DESTROY path and utilizing the xa lock to serialize operations, ensuring the reference count check and xa erase are performed within a single critical region. While this change may result in EBUSY errors if userspace operations race with destroy operations, this racing condition was already considered dangerous.
Recommendations Update to a newer version of the Linux kernel that resolves this issue.

Exploit

Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

CVE-2023-53795
RHSA-2023:6583
RHSA-2024:2394
SUSE-SU-2026:0278-1
SUSE-SU-2026:0281-1
SUSE-SU-2026:0293-1
SUSE-SU-2026:0315-1
SUSE-SU-2026:20477-1
SUSE-SU-2026:20498-1
SUSE-SU-2026:20845-1
SUSE-SU-2026:20876-1

Affected Products

Linux Kernel
Red Hat