CVE-2023-53259

VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF

HIGH

7.1

CVSS Score

Published: September 15, 2025 at 02:46 PM UTC

Updated: June 17, 2026 at 06:44 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.1

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF The call to get_user_pages_fast() in vmci_host_setup_notify() can return NULL context->notify_page causing a GPF. To avoid GPF check if context->notify_page == NULL and return error if so. general protection fault, probably for non-canonical address 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0x0005088000000300- 0x0005088000000307] CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0 Call Trace: <TASK> vmci_host_unlocked_ioctl+0x362/0x1f40 __x64_sys_ioctl+0x1a1/0x230 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

4.0 ≤ v < 5.10.2404.0 ≤ v < 5.15.994.0 ≤ v < 5.4.2964.0 ≤ v < 6.1.164.0 ≤ v < 6.2.34.0 ≤ v < 6.35.11 ≤ v < 5.15.995.16 ≤ v < 6.1.165.5 ≤ v < 5.10.2406.2 ≤ v < 6.2.34.0a1d88436d53a75e950db15834b3d2f8c0c358fdc

Vendor states this is fixed in 055891397f530f9b1b22be38d7eca8b08382941f (fixed)

Vendor states this is fixed in 1a726cb47fd204109c767409fa9ca15a96328f14 (fixed)

Vendor states this is fixed in 91b8e4f61f8f4594ee65368c8d89e6fdc29d3fb1 (fixed)

Vendor states this is fixed in a3c89e8c69a58f62451c0a75b77fcab25979b897 (fixed)

Vendor states this is fixed in b4239bfb260d1e6837766c41a0b241d7670f1402 (fixed)

Vendor states this is fixed in d4198f67e7556b1507f14f60d81a72660e5560e4 (fixed)

Vendor states this is fixed in 4.0 (unaffected)

Vendor states this is fixed in 5.10.240 (unaffected)

Vendor states this is fixed in 5.15.99 (unaffected)

Vendor states this is fixed in 5.4.296 (unaffected)

Vendor states this is fixed in 6.1.16 (unaffected)

Vendor states this is fixed in 6.2.3 (unaffected)