CVE-2023-53795

CVE-2023-53795 affects the Linux kernel IOMMUFD path. The issue is a race where IOMMUFD_DESTROY could incorrectly increment a refcount, breaking the expected protection of temporary refcount elevations. A fix changes synchronization to stop refcount increments on the DESTROY path and uses the xa_...

kernel: iommufd: IOMMUFD_DESTROY should not increase the refcount

A race condition was identified in the iommufd subsystem of the Linux kernel where the IOMMUFDDESTROY command incorrectly increments an object’s reference count without holding the expected exclusive synchronization destroyrwsem. This violates the assumption that temporary reference count...