{"id":"CVE-2023-54095","revision":"4526f9caddcf4a2b8e01052a75663750","records":[{"revision":"4526f9caddcf4a2b8e01052a75663750","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2023-54095","aliases":[],"title":"powerpc/iommu: Fix notifiers being shared by PCI and VIO buses","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: Fix notifiers being shared by PCI and VIO buses\n\nfail_iommu_setup() registers the fail_iommu_bus_notifier struct to both\nPCI and VIO buses.  struct notifier_block is a linked list node, so this\ncauses any notifiers later registered to either bus type to also be\nregistered to the other since they share the same node.\n\nThis causes issues in (at least) the vgaarb code, which registers a\nnotifier for PCI buses.  pci_notify() ends up being called on a vio\ndevice, converted with to_pci_dev() even though it's not a PCI device,\nand finally makes a bad access in vga_arbiter_add_pci_device() as\ndiscovered with KASAN:\n\n BUG: KASAN: slab-out-of-bounds in vga_arbiter_add_pci_device+0x60/0xe00\n Read of size 4 at addr c000000264c26fdc by task swapper/0/1\n\n Call Trace:\n   dump_stack_lvl+0x1bc/0x2b8 (unreliable)\n   print_report+0x3f4/0xc60\n   kasan_report+0x244/0x698\n   __asan_load4+0xe8/0x250\n   vga_arbiter_add_pci_device+0x60/0xe00\n   pci_notify+0x88/0x444\n   notifier_call_chain+0x104/0x320\n   blocking_notifier_call_chain+0xa0/0x140\n   device_add+0xac8/0x1d30\n   device_register+0x58/0x80\n   vio_register_device_node+0x9ac/0xce0\n   vio_bus_scan_register_devices+0xc4/0x13c\n   __machine_initcall_pseries_vio_device_init+0x94/0xf0\n   do_one_initcall+0x12c/0xaa8\n   kernel_init_freeable+0xa48/0xba8\n   kernel_init+0x64/0x400\n   ret_from_kernel_thread+0x5c/0x64\n\nFix this by creating separate notifier_block structs for each bus type.\n\n[mpe: Add #ifdef to fix CONFIG_IBMVIO=n build]","state":0,"publishedAt":"2025-12-24T13:06:23.157+00:00","modifiedAt":"2026-10-15T21:41:39.654+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/powerpc/kernel/iommu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6\",\n                            \"lessThan\": \"dc0d107e624ca96aef6dd8722eb33ba3a6d157b0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6\",\n                            \"lessThan\": \"075a4dcdbc9a5ea793cb8ec8b78a6c0b7636fd52\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6\",\n                            \"lessThan\": \"65bf8a196ba25cf65a858b5bb8de80f0aad76691\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6\",\n                            \"lessThan\": \"f08944e3c6962b00827de7263a9e20688e79ad84\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6\",\n                            \"lessThan\": \"a9ddbfed53465bc7c411231db32a488066c0c1be\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6\",\n                            \"lessThan\": \"f17d5efaafba3d5f02f0373f7c5f44711d676f3e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6\",\n                            \"lessThan\": \"c46af58588253e5e4063bb5ddc78cd12fdf9e55d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6\",\n                            \"lessThan\": \"6670c65bf863cd0d44ca24d4c10ef6755b8d9529\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6\",\n                            \"lessThan\": \"c37b6908f7b2bd24dcaaf14a180e28c9132b9c58\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/powerpc/kernel/iommu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.14.326\",\n                            \"lessThanOrEqual\": \"4.14.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.295\",\n                            \"lessThanOrEqual\": \"4.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.257\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.195\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.132\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.53\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.4.16\",\n                            \"lessThanOrEqual\": \"6.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.5.3\",\n                            \"lessThanOrEqual\": \"6.5.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/dc0d107e624ca96aef6dd8722eb33ba3a6d157b0","https://git.kernel.org/stable/c/075a4dcdbc9a5ea793cb8ec8b78a6c0b7636fd52","https://git.kernel.org/stable/c/65bf8a196ba25cf65a858b5bb8de80f0aad76691","https://git.kernel.org/stable/c/f08944e3c6962b00827de7263a9e20688e79ad84","https://git.kernel.org/stable/c/a9ddbfed53465bc7c411231db32a488066c0c1be","https://git.kernel.org/stable/c/f17d5efaafba3d5f02f0373f7c5f44711d676f3e","https://git.kernel.org/stable/c/c46af58588253e5e4063bb5ddc78cd12fdf9e55d","https://git.kernel.org/stable/c/6670c65bf863cd0d44ca24d4c10ef6755b8d9529","https://git.kernel.org/stable/c/c37b6908f7b2bd24dcaaf14a180e28c9132b9c58"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-54095","license":"CVE Program Terms of Use","key":"cve-program:CVE-2023-54095","identifiers":["CVE-2023-54095"]},"retained":false,"historicalAffected":[]}],"coverage":[]}