Log in Start free

Vulnerability · Published Dec 30, 2025 · Assigned by Linux

CVE-2023-54239iommufd: Check for uptr overflow

Unrated

In plain English

A security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 91.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: iommufd: Check for uptr overflow syzkaller found that setting up a map with a user VA that wraps past zero can trigger WARN_ONs, particularly from pin_user_pages weirdly returning 0 due to invalid arguments. Prevent creating a pages with a uptr and size that would math overflow. WARNING: CPU: 0 PID: 518 at drivers/iommu/iommufd/pages.c:793 pfn_reader_user_pin+0x2e6/0x390 Modules linked in: CPU: 0 PID: 518 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:pfn_reader_user_pin+0x2e6/0x390 Code: b1 11 e9 25 fe ff ff e8 28 e4 0f ff 31 ff 48 89 de e8 2e e6 0f ff 48 85 db 74 0a e8 14 e4 0f ff e9 4d ff ff ff e8 0a e4 0f ff <0f> 0b bb f2 ff ff ff e9 3c ff ff ff e8 f9 e3 0f ff ba 01 00 00 00 RSP: 0018:ffffc90000f9fa30 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff821e2b72 RDX: 0000000000000000 RSI: ffff888014184680 RDI: 0000000000000002 RBP: ffffc90000f9fa78 R08: 00000000000000ff R09: 0000000079de6f4e R10: ffffc90000f9f790 R11: ffff888014185418 R12: ffffc90000f9fc60 R13: 0000000000000002 R14: ffff888007879800 R15: 0000000000000000 FS: 00007f4227555740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000043 CR3: 000000000e748005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> pfn_reader_next+0x14a/0x7b0 ? interval_tree_double_span_iter_update+0x11a/0x140 pfn_reader_first+0x140/0x1b0 iopt_pages_rw_slow+0x71/0x280 ? __this_cpu_preempt_check+0x20/0x30 iopt_pages_rw_access+0x2b2/0x5b0 iommufd_access_rw+0x19f/0x2f0 iommufd_test+0xd11/0x16f0 ? write_comp_data+0x2f/0x90 iommufd_fops_ioctl+0x206/0x330 __x64_sys_ioctl+0x10e/0x160 ? __pfx_iommufd_fops_ioctl+0x10/0x10 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-54239
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-54239
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-54239
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-54239
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2023-54239
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2023-54239
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2023-54239
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2023-54239
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-54239
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-54239
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-54239
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-54239
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2023-54239

Affected products (as reported)

VendorProductVersions
Linux Linux 8d160cd4d5066f864ec0f2c981470e55ac03ac27 – before 800963e7eb001ada8cf2418f159fb649694467f18d160cd4d5066f864ec0f2c981470e55ac03ac27 – before e4395701330fc4aee530905039516fe770b81417
Linux Linux 6.2

References