LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53756: KVM: VMX: Fix crash due to uninitialized current_vmcs

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Fix crash due to uninitialized current_vmcs KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as a nested hypervisor on top of Hyper-V. When MSR bitmap is updated, evmcs_touch_msr_bitmap function uses current_vmcs per-cpu variable to mark that the msr bitmap was changed. vmx_vcpu_create() modifies the msr bitmap via vmx_disable_intercept_for_msr -> vmx_msr_bitmap_l01_changed which in the end calls this function. The function checks for current_vmcs if it is null but the check is insufficient because current_vmcs is not initialized. Because of this, the code might incorrectly write to the structure pointed by current_vmcs value left by another task. Preemption is not disabled, the current task can be preempted and moved to another CPU while current_vmcs is accessed multiple times from evmcs_touch_msr_bitmap() which leads to crash. The manipulation of MSR bitmaps by callers happens only for vmcs01 so the solution is to use vmx->vmcs01.vmcs instead of current_vmcs. BUG: kernel NULL pointer dereference, address: 0000000000000338 PGD 4e1775067 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI ... RIP: 0010:vmx_msr_bitmap_l01_changed+0x39/0x50 [kvm_intel] ... Call Trace: vmx_disable_intercept_for_msr+0x36/0x260 [kvm_intel] vmx_vcpu_create+0xe6/0x540 [kvm_intel] kvm_arch_vcpu_create+0x1d1/0x2e0 [kvm] kvm_vm_ioctl_create_vcpu+0x178/0x430 [kvm] kvm_vm_ioctl+0x53f/0x790 [kvm] __x64_sys_ioctl+0x8a/0xc0 do_syscall_64+0x5c/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel KVM issue can crash a host in a specific nested-virtualization setup. The risk is primarily service disruption, not proven data theft. It matters most for virtualization platforms where users or automation can create KVM virtual CPUs on Intel systems running under Hyper-V.

Executive priority

Treat as a targeted availability risk for virtualization infrastructure. Patch during the next appropriate maintenance window, faster for multi-tenant or automation-heavy KVM hosts where VM creation is exposed to less-trusted users.

Technical view

KVM VMX may use an uninitialized per-CPU current_vmcs while updating Enlightened VMCS MSR bitmaps during vCPU creation. In nested Hyper-V scenarios, preemption and CPU migration can lead to writes through a stale or null pointer, causing a kernel oops in kvm_intel.

Likely exposure

Exposure appears limited to Linux systems using KVM Intel VMX as a nested hypervisor on Hyper-V with Enlightened VMCS/MSR Bitmap paths active. Hosts without KVM, Intel VMX, nested virtualization, or Hyper-V underneath are less likely to be exposed based on the provided description.

Exploitation context

The bundle does not show CISA KEV listing, public exploitation, exploit code, or CVSS scoring. The crash path is reached during KVM vCPU creation through ioctl handling, so practical abuse likely requires local access capable of creating KVM virtual machines.

Researcher notes

The source attributes the fix to replacing current_vmcs with vmx->vmcs01.vmcs for MSR bitmap manipulation. Evidence is strong for crash behavior in the described path, but incomplete for affected distribution builds, CVSS severity, and real-world exploitation.

Mitigation direction

  • Apply vendor kernel updates containing the referenced stable KVM VMX fixes.
  • Prioritize Hyper-V-nested Linux KVM hosts using Intel VMX.
  • Restrict KVM device access to trusted administrators and automation.
  • Disable nested virtualization where operationally feasible until patched.
  • Monitor vendor advisories for exact distribution package versions.

Validation and detection

  • Inventory hosts running Linux KVM with kvm_intel enabled.
  • Identify systems nested on Hyper-V with Enlightened VMCS in use.
  • Check kernel packages or source trees for the referenced stable commits.
  • Review kernel logs for related KVM VMX oops or NULL pointer dereferences.
  • Confirm only approved users or services can access KVM device nodes.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53756 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxceef7d10dfb6284d512c499292e6daa35ea83f90, ceef7d10dfb6284d512c499292e6daa35ea83f90, ceef7d10dfb6284d512c499292e6daa35ea83f90, ceef7d10dfb6284d512c499292e6daa35ea83f90, ceef7d10dfb6284d512c499292e6daa35ea83f90unaffected
LinuxLinux4.18, 0, 5.10.175, 5.15.103, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.