Linux kernel (drivers/pci): The DOE state machine signals the caller's completion before destroying the work_struct

CVSS 5.9CVE-2023-54235Kernel, userspace & hypervisorcurated

Impact

The DOE state machine signals the caller's completion before destroying the work_struct that lives on the caller's stack, so the workqueue can still be touching a stack frame the caller has already left. DOE is the mailbox that carries CMA/SPDM device attestation and IDE link-encryption negotiation, which makes this a race in exactly the machinery a confidential-GPU deployment relies on to decide whether a device is trustworthy.

Who can reach it

Host-side only, on nodes where a device exposes a DOE mailbox and something drives it - CXL, device attestation (CMA/SPDM), or IDE key exchange. There is no tenant-facing entry point: the race is between the DOE workqueue and the kernel thread that submitted the task, and its timing is influenced by how slowly the device answers, so a slow or deliberately laggy device shifts the window. Nodes with no DOE-capable device, or with attestation/IDE unused, never execute the path.

What to do

Update to 6.1.53 / 6.3 or later, where the work struct is destroyed before the completion is signalled. Interim: on affected kernels avoid driving DOE in production - leave CMA/SPDM attestation and IDE negotiation disabled until patched rather than running them against untrusted devices.

References

https://git.kernel.org/stable/c/d96799ee3b78962c80e4b6653734f488f999ca09 https://git.kernel.org/stable/c/c4f9c0a3a6df143f2e1092823b7fa9e07d6ab57f https://nvd.nist.gov/vuln/detail/CVE-2023-54235

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.