LiveActive security incident?Get immediate response
CVE Record

CVE-2023-52484: iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range When running an SVA case, the following soft lockup is triggered: -------------------------------------------------------------------- watchdog: BUG: soft lockup - CPU#244 stuck for 26s! pstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : arm_smmu_cmdq_issue_cmdlist+0x178/0xa50 lr : arm_smmu_cmdq_issue_cmdlist+0x150/0xa50 sp : ffff8000d83ef290 x29: ffff8000d83ef290 x28: 000000003b9aca00 x27: 0000000000000000 x26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: 0000000000000000 x23: 0000000000000040 x22: ffff8000d83ef340 x21: ffff0000c63980c0 x20: 0000000000000001 x19: ffff0000c6398080 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffff3000b4a3bbb0 x14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc08120e4d6bc x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000048cfa x5 : 0000000000000000 x4 : 0000000000000001 x3 : 000000000000000a x2 : 0000000080000000 x1 : 0000000000000000 x0 : 0000000000000001 Call trace: arm_smmu_cmdq_issue_cmdlist+0x178/0xa50 __arm_smmu_tlb_inv_range+0x118/0x254 arm_smmu_tlb_inv_range_asid+0x6c/0x130 arm_smmu_mm_invalidate_range+0xa0/0xa4 __mmu_notifier_invalidate_range_end+0x88/0x120 unmap_vmas+0x194/0x1e0 unmap_region+0xb4/0x144 do_mas_align_munmap+0x290/0x490 do_mas_munmap+0xbc/0x124 __vm_munmap+0xa8/0x19c __arm64_sys_munmap+0x28/0x50 invoke_syscall+0x78/0x11c el0_svc_common.constprop.0+0x58/0x1c0 do_el0_svc+0x34/0x60 el0_svc+0x2c/0xd4 el0t_64_sync_handler+0x114/0x140 el0t_64_sync+0x1a4/0x1a8 -------------------------------------------------------------------- Note that since 6.6-rc1 the arm_smmu_mm_invalidate_range above is renamed to "arm_smmu_mm_arch_invalidate_secondary_tlbs", yet the problem remains. The commit 06ff87bae8d3 ("arm64: mm: remove unused functions and variable protoypes") fixed a similar lockup on the CPU MMU side. Yet, it can occur to SMMU too, since arm_smmu_mm_arch_invalidate_secondary_tlbs() is called typically next to MMU tlb flush function, e.g. tlb_flush_mmu_tlbonly { tlb_flush { __flush_tlb_range { // check MAX_TLBI_OPS } } mmu_notifier_arch_invalidate_secondary_tlbs { arm_smmu_mm_arch_invalidate_secondary_tlbs { // does not check MAX_TLBI_OPS } } } Clone a CMDQ_MAX_TLBI_OPS from the MAX_TLBI_OPS in tlbflush.h, since in an SVA case SMMU uses the CPU page table, so it makes sense to align with the tlbflush code. Then, replace per-page TLBI commands with a single per-asid TLBI command, if the request size hits this threshold.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-52484 is a Linux kernel availability bug affecting Arm systems using SMMU v3 with shared virtual addressing. Under certain memory unmap or invalidation workloads, the kernel can spend too long issuing invalidation commands and trigger a soft lockup. The public record does not show data theft, privilege escalation, or confirmed exploitation.

Executive priority

Treat this as a targeted availability risk, not a broad emergency. Patch affected Arm infrastructure during the next appropriate maintenance window, sooner for systems where kernel lockups would disrupt production services or tenant workloads.

Technical view

The flaw is in the arm-smmu-v3 IOMMU path during SVA-related secondary TLB invalidation. Large invalidate ranges could issue per-page TLBI commands without the CPU-side MAX_TLBI_OPS-style threshold, causing a soft lockup. The fix aligns SMMU behavior with CPU TLB flushing by switching to a per-ASID TLBI when the command threshold is reached.

Likely exposure

Exposure is likely limited to Linux on Arm platforms using SMMU v3 and SVA-related IOMMU paths. Generic x86 Linux systems are not indicated by the sources. Downstream distro kernels may differ, so affected status should be checked against vendor kernel advisories and the listed stable kernel commits.

Exploitation context

The sources describe a reliability failure observed during an SVA case and do not identify public exploitation, weaponized proof of concept, or CISA KEV listing. The practical impact appears to be denial of service through kernel soft lockup under specific hardware and workload conditions.

Researcher notes

Evidence is strongest for the specific arm-smmu-v3 SVA invalidation path. The CVE record provides no CVSS, CWE, exploit status, or detailed attacker prerequisites. Avoid broad claims beyond Arm SMMU v3 Linux exposure unless confirmed by downstream vendor advisories.

Mitigation direction

  • Update to a vendor kernel containing the referenced arm-smmu-v3 fix.
  • Prioritize Arm systems using SMMU v3 and SVA-capable devices.
  • Check Linux distribution advisories for backported fixes.
  • Monitor kernel logs for watchdog soft lockup messages in arm_smmu paths.

Validation and detection

  • Inventory Arm Linux hosts and confirm SMMU v3 and SVA usage.
  • Compare running kernel builds against vendor advisories or stable commit inclusion.
  • Review logs for arm_smmu_cmdq_issue_cmdlist soft lockup traces.
  • Confirm patched kernels retain normal IOMMU and device workload behavior.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-52484 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux51d113c3be09ff5b916576b1109daf413549cacc, 51d113c3be09ff5b916576b1109daf413549cacc, 51d113c3be09ff5b916576b1109daf413549cacc, 51d113c3be09ff5b916576b1109daf413549caccunaffected
LinuxLinux5.12, 0, 5.15.134, 6.1.56, 6.5.6, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.