CVE-2023-53795

In the Linux kernel, the following vulnerability has been resolved: iommufd: IOMMUFDDESTROY should not increase the refcount syzkaller found a race where IOMMUFDDESTROY increments the refcount: obj = iommufdgetobjectucmd-ictx, cmd-id, IOMMUFDOBJANY; if ISERRobj return PTRERRobj;...

UBUNTU-CVE-2023-53795

In the Linux kernel, the following vulnerability has been resolved: iommufd: IOMMUFDDESTROY should not increase the refcount syzkaller found a race where IOMMUFDDESTROY increments the refcount: obj = iommufdgetobjectucmd-ictx, cmd-id, IOMMUFDOBJANY; if ISERRobj return PTRERRobj;...

CVE-2023-53795

CVE-2023-53795 affects the Linux kernel IOMMUFD path. The issue is a race where IOMMUFD_DESTROY could incorrectly increment a refcount, breaking the expected protection of temporary refcount elevations. A fix changes synchronization to stop refcount increments on the DESTROY path and uses the xa_...