Log in Start free

Vulnerability · Published Sep 15, 2025 · Assigned by Linux

CVE-2023-53171vfio/type1: prevent underflow of locked_vm via exec()

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 94.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: vfio/type1: prevent underflow of locked_vm via exec() When a vfio container is preserved across exec, the task does not change, but it gets a new mm with locked_vm=0, and loses the count from existing dma mappings. If the user later unmaps a dma mapping, locked_vm underflows to a large unsigned value, and a subsequent dma map request fails with ENOMEM in __account_locked_vm. To avoid underflow, grab and save the mm at the time a dma is mapped. Use that mm when adjusting locked_vm, rather than re-acquiring the saved task's mm, which may have changed. If the saved mm is dead, do nothing. locked_vm is incremented for existing mappings in a subsequent patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.20-1DEBIAN-CVE-2023-53171
Debian:13linux6.1.20-1DEBIAN-CVE-2023-53171
Debian:14linux6.1.20-1DEBIAN-CVE-2023-53171
Ubuntu:22.04:LTSlinux5.15.0-75.82UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-aws5.15.0-1038.43UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-azure5.15.0-1040.47UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-53171
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1041.48.1UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-gcp5.15.0-1036.44UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-53171
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-gke5.15.0-1036.41UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1022.27UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-53171
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-ibm5.15.0-1032.35UBUNTU-CVE-2023-53171
Ubuntu:24.04:LTSlinux-intelno fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1033.38UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-kvm5.15.0-1035.40UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-75.82UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-53171
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1027.27UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1015.15UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2023-53171
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2023-53171
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-oracle5.15.0-1037.43UBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-raspi5.15.0-1032.35UBUNTU-CVE-2023-53171
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-53171
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-53171
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-53171
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2023-53171

Affected products (as reported)

VendorProductVersions
Linux Linux 73fa0d10d077d9521ee2dace2307ae2c9a965336 – before 5a271242716846cc016736fb76be2b40ee49b0c373fa0d10d077d9521ee2dace2307ae2c9a965336 – before eafb81c50da899dd80b340c841277acc4a1945b773fa0d10d077d9521ee2dace2307ae2c9a965336 – before a6b2aabe664098d5cf877ae0fd96459464a30e1773fa0d10d077d9521ee2dace2307ae2c9a965336 – before b0790dff0760b7734cf0961f497ad64628ca550b73fa0d10d077d9521ee2dace2307ae2c9a965336 – before 046eca5018f8a5dd1dc2cedf87fb5843b9ea3026
Linux Linux 3.6

References