{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2023-54095", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2023-54095", "idYear": 2023, "status": "PUBLISHED", "publishedAt": "2025-12-24T13:06:23.157Z", "updatedAt": "2026-10-15T21:41:39.654Z", "importedAt": "2026-10-24T01:57:03.413Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "powerpc/iommu: Fix notifiers being shared by PCI and VIO buses", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: Fix notifiers being shared by PCI and VIO buses\n\nfail_iommu_setup() registers the fail_iommu_bus_notifier struct to both\nPCI and VIO buses. struct notifier_block is a linked list node, so this\ncauses any notifiers later registered to either bus type to also be\nregistered to the other since they share the same node.\n\nThis causes issues in (at least) the vgaarb code, which registers a\nnotifier for PCI buses. pci_notify() ends up being called on a vio\ndevice, converted with to_pci_dev() even though it's not a PCI device,\nand finally makes a bad access in vga_arbiter_add_pci_device() as\ndiscovered with KASAN:\n\n BUG: KASAN: slab-out-of-bounds in vga_arbiter_add_pci_device+0x60/0xe00\n Read of size 4 at addr c000000264c26fdc by task swapper/0/1\n\n Call Trace:\n dump_stack_lvl+0x1bc/0x2b8 (unreliable)\n print_report+0x3f4/0xc60\n kasan_report+0x244/0x698\n __asan_load4+0xe8/0x250\n vga_arbiter_add_pci_device+0x60/0xe00\n pci_notify+0x88/0x444\n notifier_call_chain+0x104/0x320\n blocking_notifier_call_chain+0xa0/0x140\n device_add+0xac8/0x1d30\n device_register+0x58/0x80\n vio_register_device_node+0x9ac/0xce0\n vio_bus_scan_register_devices+0xc4/0x13c\n __machine_initcall_pseries_vio_device_init+0x94/0xf0\n do_one_initcall+0x12c/0xaa8\n kernel_init_freeable+0xa48/0xba8\n kernel_init+0x64/0x400\n ret_from_kernel_thread+0x5c/0x64\n\nFix this by creating separate notifier_block structs for each bus type.\n\n[mpe: Add #ifdef to fix CONFIG_IBMVIO=n build]", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "status": "affected", "versionType": "git", "lessThan": "dc0d107e624ca96aef6dd8722eb33ba3a6d157b0" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "status": "affected", "versionType": "git", "lessThan": "075a4dcdbc9a5ea793cb8ec8b78a6c0b7636fd52" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "status": "affected", "versionType": "git", "lessThan": "65bf8a196ba25cf65a858b5bb8de80f0aad76691" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "status": "affected", "versionType": "git", "lessThan": "f08944e3c6962b00827de7263a9e20688e79ad84" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "status": "affected", "versionType": "git", "lessThan": "a9ddbfed53465bc7c411231db32a488066c0c1be" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "status": "affected", "versionType": "git", "lessThan": "f17d5efaafba3d5f02f0373f7c5f44711d676f3e" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "status": "affected", "versionType": "git", "lessThan": "c46af58588253e5e4063bb5ddc78cd12fdf9e55d" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "status": "affected", "versionType": "git", "lessThan": "6670c65bf863cd0d44ca24d4c10ef6755b8d9529" }, { "version": "d6b9a81b2a45786384f5bd3516bd6ddfb4b772c6", "status": "affected", "versionType": "git", "lessThan": "c37b6908f7b2bd24dcaaf14a180e28c9132b9c58" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "3.6", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "3.6" }, { "version": "4.14.326", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.14.*" }, { "version": "4.19.295", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.19.*" }, { "version": "5.4.257", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.4.*" }, { "version": "5.10.195", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.132", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.53", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.4.16", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.4.*" }, { "version": "6.5.3", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.5.*" }, { "version": "6.6", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }