LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54007: vmci_host: fix a race condition in vmci_host_poll() causing GPF

In the Linux kernel, the following vulnerability has been resolved: vmci_host: fix a race condition in vmci_host_poll() causing GPF During fuzzing, a general protection fault is observed in vmci_host_poll(). general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926 <- omitting registers -> Call Trace: <TASK> lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162 add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22 poll_wait include/linux/poll.h:49 [inline] vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174 vfs_poll include/linux/poll.h:88 [inline] do_pollfd fs/select.c:873 [inline] do_poll fs/select.c:921 [inline] do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015 __do_sys_ppoll fs/select.c:1121 [inline] __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Example thread interleaving that causes the general protection fault is as follows: CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context) ----- ----- // Read uninitialized context context = vmci_host_dev->context; // Initialize context vmci_host_dev->context = vmci_ctx_create(); vmci_host_dev->ct_type = VMCIOBJ_CONTEXT; if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { // Dereferencing the wrong pointer poll_wait(..., &context->host_context); } In this scenario, vmci_host_poll() reads vmci_host_dev->context first, and then reads vmci_host_dev->ct_type to check that vmci_host_dev->context is initialized. However, since these two reads are not atomically executed, there is a chance of a race condition as described above. To fix this race condition, read vmci_host_dev->context after checking the value of vmci_host_dev->ct_type so that vmci_host_poll() always reads an initialized context.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-54007 is a Linux kernel race condition in vmci_host polling that can trigger a general protection fault. In business terms, the known impact is likely system instability or denial of service, not proven data theft. The source bundle provides no CVSS score and no KEV evidence of active exploitation.

Executive priority

Prioritize remediation on systems where kernel crashes would disrupt production or availability commitments. The urgency is lower than a proven remote code execution issue, but kernel-level denial of service risk warrants normal patch-cycle attention.

Technical view

vmci_host_poll() can read vmci_host_dev->context before vmci_host_dev->ct_type is updated by initialization on another CPU. If the type check later succeeds, the poll path can dereference the wrong or uninitialized context pointer and fault. The kernel fix changes read ordering so context is read after confirming ct_type.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions with the vmci_host/vmw_vmci driver code present and reachable. Confirm actual risk by checking kernel version, downstream vendor backports, and whether the relevant driver is enabled or loaded.

Exploitation context

The source states the issue was observed during fuzzing and provides a kernel crash trace. KEV is false in the bundle, and no cited source reports active exploitation or a public exploit. Treat exploitation evidence as unproven from these materials.

Researcher notes

The affected path is a poll-time race in drivers/misc/vmw_vmci/vmci_host.c. The fix is semantic rather than broad hardening: read ct_type first, then read context only when the object is confirmed as VMCIOBJ_CONTEXT. Evidence is limited to the CVE description and stable kernel references.

Mitigation direction

  • Update to a Linux kernel or vendor package containing the referenced stable fixes.
  • Check distribution advisories for backported fixes before relying only on version numbers.
  • Reduce exposure to the vmci_host driver if it is unnecessary in the environment.
  • Monitor kernels using affected version ranges until vendor remediation is applied.

Validation and detection

  • Inventory Linux kernel versions across affected servers and workloads.
  • Verify whether vmw_vmci or vmci_host support is built, loaded, or required.
  • Confirm the applicable stable fix commit or downstream backport is present.
  • Review crash logs for general protection faults in vmci_host_poll().
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54007 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8bf503991f87e32ea42a7bd69b79ba084fddc5d7, 8bf503991f87e32ea42a7bd69b79ba084fddc5d7, 8bf503991f87e32ea42a7bd69b79ba084fddc5d7, 8bf503991f87e32ea42a7bd69b79ba084fddc5d7, 8bf503991f87e32ea42a7bd69b79ba084fddc5d7, 8bf503991f87e32ea42a7bd69b79ba084fddc5d7, 8bf503991f87e32ea42a7bd69b79ba084fddc5d7, 8bf503991f87e32ea42a7bd69b79ba084fddc5d7unaffected
LinuxLinux3.9, 0, 4.19.283, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.