CVE-2023-54034 iommufd: Make sure to zero vfio_iommu_type1_info before copying to user

Not scored Published 24 Dec 2025 Updated 11 May 2026

A local attacker can read uninitialized kernel memory via the iommufd subsystem due to missing zero initialization in vfio_iommu_type1_info.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-54034?

CVE-2023-54034 is a vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Make sure to zero vfio_iommu_type1_info before copying to user

Missed a zero initialization here. Most of the struct is filled with a copy_from_user(), however minsz for that copy is smaller than the actual struct by 8 bytes, thus we don't fill the padding.

Which versions are affected by CVE-2023-54034?

How do I fix CVE-2023-54034?

Apply the vendor's patch.

Is CVE-2023-54034 being exploited?

There is no known exploitation of CVE-2023-54034 in the wild and no public exploit code.

Sources

Also known as BELL-CVE-2023-54034, GHSA-47gj-cqh4-pq8c, UBUNTU-CVE-2023-54034.