Linux kernel (drivers/iommu/amd): Unbinding a PASID races the I/O page-fault (PPR) notifications still in flight

CVSS 5.0CVE-2023-53501Kernel, userspace & hypervisorcurated

Impact

Unbinding a PASID races the I/O page-fault (PPR) notifications still in flight against it. The refcount that is supposed to keep the PASID state alive until outstanding faults drain hits zero on the unbind path, so the state object can be torn down while the fault handler is still using it - a PASID/SVA lifetime break on AMD-Vi. Upstream's observable is a refcount warning plus leaked state rather than a demonstrated use-after-free.

Who can reach it

A process using AMD SVA/PASID that unbinds while its device still has page-fault requests outstanding - i.e. a tenant workload that programs a PASID-capable accelerator and exits with DMA still pending. No host root. Conditional on AMD-Vi with the iommu_v2 PASID/PPR path in use.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not enable SVA/PASID for tenant workloads on unpatched AMD-Vi hosts.

References

https://git.kernel.org/stable/c/a50d60b8f2aff46dd7c7edb4a5835cdc4d432c22 https://git.kernel.org/stable/c/13ed255248dfbbb7f23f9170c7a537fb9ca22c73 https://nvd.nist.gov/vuln/detail/CVE-2023-53501

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.