# CVE-2023-54089: virtio_pmem: add the missing REQ_OP_WRITE for flush bio

> A missing operation flag in the Linux kernel virtio_pmem driver causes a kernel warning and potential denial of service during filesystem operations on persistent memory devices.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Dec 2025
- **Updated:** 11 May 2026
- **Also known as:** BELL-CVE-2023-54089, DEBIAN-CVE-2023-54089, GHSA-v2v9-hx36-32x2, UBUNTU-CVE-2023-54089

## What is CVE-2023-54089?

CVE-2023-54089 is a denial of service vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

virtio_pmem: add the missing REQ_OP_WRITE for flush bio

When doing mkfs.xfs on a pmem device, the following warning was

 ------------[ cut here ]------------
 WARNING: CPU: 2 PID: 384 at block/blk-core.c:751 submit_bio_noacct
 Modules linked in:
 CPU: 2 PID: 384 Comm: mkfs.xfs Not tainted 6.4.0-rc7+ #154
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
 RIP: 0010:submit_bio_noacct+0x340/0x520
 ......
 Call Trace:
  <TASK>
  ? submit_bio_noacct+0xd5/0x520
  submit_bio+0x37/0x60
  async_pmem_flush+0x79/0xa0
  nvdimm_flush+0x17/0x40
  pmem_submit_bio+0x370/0x390
  __submit_bio+0xbc/0x190
  submit_bio_noacct_nocheck+0x14d/0x370
  submit_bio_noacct+0x1ef/0x520
  submit_bio+0x55/0x60
  submit_bio_wait+0x5a/0xc0
  blkdev_issue_flush+0x44/0x60

The root cause is that submit_bio_noacct() needs bio_op() is either
WRITE or ZONE_APPEND for flush bio and async_pmem_flush() doesn't assign
REQ_OP_WRITE when allocating flush bio, so submit_bio_noacct just fail
the flush bio.

Simply fix it by adding the missing REQ_OP_WRITE for flush bio. And we
could fix the flush order issue and do flush optimization later.

## Which versions are affected by CVE-2023-54089?


## How do I fix CVE-2023-54089?

Apply the vendor's patch.

## Is CVE-2023-54089 being exploited?

There is no known exploitation of CVE-2023-54089 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2023-54089 and fix it if it is affected.

What it is: CVE-2023-54089 is a denial of service vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2023-54089 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2023-54089/ (Markdown: https://insights.sbomify.com/CVE-2023-54089/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2023-54089
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-54089
- OSV: https://osv.dev/vulnerability/CVE-2023-54089

---
From sbomify Insights: https://insights.sbomify.com/CVE-2023-54089/
Summaries are generated and may contain mistakes; the official description above is the record.