In the Linux kernel, the following vulnerability has been resolved:

vmci_host: fix a race condition in vmci_host_poll() causing GPF

During fuzzing, a general protection fault is observed in
vmci_host_poll().

general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf]
RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926
<- omitting registers ->
Call Trace:
<TASK>
lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162
add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22
poll_wait include/linux/poll.h:49 [inline]
vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174
vfs_poll include/linux/poll.h:88 [inline]
do_pollfd fs/select.c:873 [inline]
do_poll fs/select.c:921 [inline]
do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015
__do_sys_ppoll fs/select.c:1121 [inline]
__se_sys_ppoll+0x2cc/0x330 fs/select.c:1101
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x46/0xb0

Example thread interleaving that causes the general protection fault
is as follows:

CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context)
----- -----
// Read uninitialized context
context = vmci_host_dev->context;
// Initialize context
vmci_host_dev->context = vmci_ctx_create();
vmci_host_dev->ct_type = VMCIOBJ_CONTEXT;

if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
// Dereferencing the wrong pointer
poll_wait(..., &context->host_context);
}

In this scenario, vmci_host_poll() reads vmci_host_dev->context first,
and then reads vmci_host_dev->ct_type to check that
vmci_host_dev->context is initialized. However, since these two reads
are not atomically executed, there is a chance of a race condition as
described above.

To fix this race condition, read vmci_host_dev->context after checking
the value of vmci_host_dev->ct_type so that vmci_host_poll() always
reads an initialized context.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00035.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
8bf503991f87e32ea42a7bd69b79ba084fddc5d7 affected < 2053e93ac15519ed1f1fe6eba79a33a4963be4a3
8bf503991f87e32ea42a7bd69b79ba084fddc5d7 affected < ca0f4ad2b7a36c799213ef0a213eb977a51e03dc
8bf503991f87e32ea42a7bd69b79ba084fddc5d7 affected < 85b4aa4eb2e3a0da111fd0a1cdbf00f986ac6b6b
8bf503991f87e32ea42a7bd69b79ba084fddc5d7 affected < 770d30b1355c6c8879973dd054fca9168def182c
8bf503991f87e32ea42a7bd69b79ba084fddc5d7 affected < d22b2a35729cb1de311cb650cd67518a24e13fc9
8bf503991f87e32ea42a7bd69b79ba084fddc5d7 affected < 67e35824f861a05b44b19d38e16a83f653bd9d92
8bf503991f87e32ea42a7bd69b79ba084fddc5d7 affected < ab64bd32b9fac27ff4737d63711b9db5e5462448
8bf503991f87e32ea42a7bd69b79ba084fddc5d7 affected < ae13381da5ff0e8e084c0323c3cc0a945e43e9c7
Linux Linux affected
Version Status Constraints
3.9 affected —
0 unaffected < 3.9
4.19.283 unaffected ≤ 4.19.*
5.4.243 unaffected ≤ 5.4.*
5.10.180 unaffected ≤ 5.10.*
5.15.111 unaffected ≤ 5.15.*
6.1.28 unaffected ≤ 6.1.*
6.2.15 unaffected ≤ 6.2.*
6.3.2 unaffected ≤ 6.3.*
6.4 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2053e93ac15519ed1f1fe6eba79a33a4963be4a3 cve-icon cve-icon
https://git.kernel.org/stable/c/67e35824f861a05b44b19d38e16a83f653bd9d92 cve-icon cve-icon
https://git.kernel.org/stable/c/770d30b1355c6c8879973dd054fca9168def182c cve-icon cve-icon
https://git.kernel.org/stable/c/85b4aa4eb2e3a0da111fd0a1cdbf00f986ac6b6b cve-icon cve-icon
https://git.kernel.org/stable/c/ab64bd32b9fac27ff4737d63711b9db5e5462448 cve-icon cve-icon
https://git.kernel.org/stable/c/ae13381da5ff0e8e084c0323c3cc0a945e43e9c7 cve-icon cve-icon
https://git.kernel.org/stable/c/ca0f4ad2b7a36c799213ef0a213eb977a51e03dc cve-icon cve-icon
https://git.kernel.org/stable/c/d22b2a35729cb1de311cb650cd67518a24e13fc9 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025122429-CVE-2023-54007-89b1@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-54007 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-54007 cve-icon
History

Fri, 26 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Wed, 24 Dec 2025 11:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: vmci_host: fix a race condition in vmci_host_poll() causing GPF During fuzzing, a general protection fault is observed in vmci_host_poll(). general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926 <- omitting registers -> Call Trace: <TASK> lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162 add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22 poll_wait include/linux/poll.h:49 [inline] vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174 vfs_poll include/linux/poll.h:88 [inline] do_pollfd fs/select.c:873 [inline] do_poll fs/select.c:921 [inline] do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015 __do_sys_ppoll fs/select.c:1121 [inline] __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Example thread interleaving that causes the general protection fault is as follows: CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context) ----- ----- // Read uninitialized context context = vmci_host_dev->context; // Initialize context vmci_host_dev->context = vmci_ctx_create(); vmci_host_dev->ct_type = VMCIOBJ_CONTEXT; if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { // Dereferencing the wrong pointer poll_wait(..., &context->host_context); } In this scenario, vmci_host_poll() reads vmci_host_dev->context first, and then reads vmci_host_dev->ct_type to check that vmci_host_dev->context is initialized. However, since these two reads are not atomically executed, there is a chance of a race condition as described above. To fix this race condition, read vmci_host_dev->context after checking the value of vmci_host_dev->ct_type so that vmci_host_poll() always reads an initialized context.
Title vmci_host: fix a race condition in vmci_host_poll() causing GPF
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-24T10:55:41.281Z

Reserved: 2025-12-24T10:53:46.177Z

Link: CVE-2023-54007

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-24T11:15:53.633

Modified: 2025-12-29T15:58:56.260

Link: CVE-2023-54007

cve-icon Redhat

Severity : Low

Publid Date: 2025-12-24T00:00:00Z

Links: CVE-2023-54007 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.