CVE-2023-53171 vfio/type1: prevent underflow of locked_vm via exec()
A local attacker can cause a denial of service in the Linux kernel by triggering an integer underflow in VFIO locked_vm accounting via exec().
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53171?
CVE-2023-53171 is a medium-severity vulnerability in Linux kernel, published on 15 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vfio/type1: prevent underflow of locked_vm via exec()
When a vfio container is preserved across exec, the task does not change, but it gets a new mm with locked_vm=0, and loses the count from existing dma mappings. If the user later unmaps a dma mapping, locked_vm underflows to a large unsigned value, and a subsequent dma map request fails with ENOMEM in __account_locked_vm.
To avoid underflow, grab and save the mm at the time a dma is mapped. Use that mm when adjusting locked_vm, rather than re-acquiring the saved task's mm, which may have changed. If the saved mm is dead, do nothing.
locked_vm is incremented for existing mappings in a subsequent patch.
Which versions are affected by CVE-2023-53171?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53171?
Apply the vendor's patch.
Is CVE-2023-53171 being exploited?
There is no known exploitation of CVE-2023-53171 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53171, DEBIAN-CVE-2023-53171, GHSA-w3pr-pqpr-2f83, UBUNTU-CVE-2023-53171.