Linux kernel (arch/s390/pci): When an SR-IOV VF is hot-unplugged its MMIO resources are freed, but the parent bus keeps

CVSS 7.0CVE-2023-53123Kernel, userspace & hypervisorcurated

Impact

When an SR-IOV VF is hot-unplugged its MMIO resources are freed, but the parent bus keeps pointers to them in its resource list. When the VF is plugged back in - the normal churn of reclaiming a VF from one tenant and issuing it to the next - the stale resources are claimed again, giving a use-after-free on the structures that describe which MMIO window belongs to which function. Resource metadata is the wrong thing to have dangling on a machine that partitions devices between tenants.

Who can reach it

Host-side, and s390 only - the bug lives in the s390 PCI implementation, where individual functions of a multi-function/SR-IOV device can be hotplugged independently (the core change to drivers/pci/bus.c is the supporting API, not the flaw). x86_64 and arm64 GPU nodes are not affected. Triggered by the VF remove/re-add cycle, i.e. by the operator's own VF lifecycle automation rather than directly by a tenant; a tenant that can make its VF drop and reappear influences the timing.

What to do

Boot a patched kernel on any s390 node (the fix adds pci_bus_remove_resource() and drops per-function resources on unplug). Interim on s390: avoid the VF remove/re-add cycle - reboot the LPAR rather than recycling individual VFs between workloads. No action needed on x86_64/arm64 GPU nodes.

References

https://git.kernel.org/stable/c/437bb839e36cc9f35adc6d2a2bf113b7a0fc9985 https://git.kernel.org/stable/c/a2410d0c3d2d714ed968a135dfcbed6aa3ff7027 https://nvd.nist.gov/vuln/detail/CVE-2023-53123

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.