LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54081: xen: speed up grant-table reclaim

In the Linux kernel, the following vulnerability has been resolved: xen: speed up grant-table reclaim When a grant entry is still in use by the remote domain, Linux must put it on a deferred list. Normally, this list is very short, because the PV network and block protocols expect the backend to unmap the grant first. However, Qubes OS's GUI protocol is subject to the constraints of the X Window System, and as such winds up with the frontend unmapping the window first. As a result, the list can grow very large, resulting in a massive memory leak and eventual VM freeze. To partially solve this problem, make the number of entries that the VM will attempt to free at each iteration tunable. The default is still 10, but it can be overridden via a module parameter. This is Cc: stable because (when combined with appropriate userspace changes) it fixes a severe performance and stability problem for Qubes OS users.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This CVE describes a Linux Xen stability problem. Under specific grant-table reclaim behavior, especially noted for Qubes OS GUI usage, memory can leak until a VM freezes. The source does not provide a CVSS score, CWE, or evidence of active exploitation.

Executive priority

Prioritize for Xen and Qubes OS environments where VM availability matters. It is less urgent for systems without Xen exposure, and current evidence does not support emergency exploitation response.

Technical view

If a Xen grant entry remains used by a remote domain, Linux defers reclaim. The list is normally short, but Qubes OS GUI behavior can make it grow very large. The fix adds a tunable reclaim batch size while keeping the default at 10 entries.

Likely exposure

Exposure appears concentrated in Linux systems using Xen grant tables, with Qubes OS GUI protocol users specifically called out. General Linux systems not using this Xen path are not clearly exposed from the provided sources.

Exploitation context

CISA KEV status is false in the bundle, and no cited source claims active exploitation. The described impact is stability and availability degradation, not a demonstrated remote code execution path.

Researcher notes

The record lacks CVSS, CWE, and precise exploitability detail. The useful technical pivot is Xen grant-table deferred reclaim growth under remote-domain grant usage, with Qubes OS GUI behavior named as the stress case.

Mitigation direction

  • Check Linux distribution and Qubes OS vendor guidance for CVE-2023-54081.
  • Update affected Linux kernels to releases containing the referenced stable fixes.
  • Verify Qubes OS userspace requirements if vendor guidance mentions them.
  • Monitor affected VMs for memory growth or freeze symptoms.

Validation and detection

  • Inventory Linux systems using Xen grant-table functionality.
  • Identify Qubes OS deployments using the GUI protocol described in the CVE.
  • Compare kernel changelogs against the referenced stable commits.
  • Confirm whether vendor packages include the reclaim tuning fix.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54081 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux569ca5b3f94cd0b3295ec5943aa457cf4a4f6a3a, 569ca5b3f94cd0b3295ec5943aa457cf4a4f6a3a, 569ca5b3f94cd0b3295ec5943aa457cf4a4f6a3aunaffected
LinuxLinux3.5, 0, 6.1.43, 6.4.8, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.