CVE-2023-53501
EUVD-2025-3277701.10.2025, 12:15
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind
When unbinding pasid - a race condition exists vs outstanding page faults.
To prevent this, the pasid_state object contains a refcount.
* set to 1 on pasid bind
* incremented on each ppr notification start
* decremented on each ppr notification done
* decremented on pasid unbind
Since refcount_dec assumes that refcount will never reach 0:
the current implementation causes the following to be invoked on
pasid unbind:
REFCOUNT_WARN("decrement hit 0; leaking memory")
Fix this issue by changing refcount_dec to refcount_dec_and_test
to explicitly handle refcount=1.EnginsightAffected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| linux | linux_kernel | 5.15 ≤ 𝑥 < 5.15.132 |
| linux | linux_kernel | 5.16 ≤ 𝑥 < 6.1.53 |
| linux | linux_kernel | 6.2 ≤ 𝑥 < 6.4.16 |
| linux | linux_kernel | 6.5 ≤ 𝑥 < 6.5.3 |
𝑥
= Vulnerable software versions
Debian Releases
References