CVE-2023-54008
Improper Affinity Mask Handling in Linux virtio_vdpa Causes Kernel Warning
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's virtio_vdpa component involves the unconditional building of affinity masks via create_affinity_masks(). This approach can cause issues because the affinity mask is not used for parents without affinity support and the logic may fail for devices like networking devices where the number of queues can exceed the number of CPUs. This mismatch breaks the affinity logic based on group_cpus_evenly(), potentially triggering warnings and unstable behavior. The fix involves building affinity masks only when the driver passes an affinity descriptor and the parent supports affinity setting configuration operations, preventing these warnings and improving stability.
How can this vulnerability impact me? :
This vulnerability can lead to warnings and potential instability in the Linux kernel when handling devices with more queues than CPUs, such as certain networking devices. It may cause improper CPU affinity assignment, which can degrade performance or cause unexpected behavior in device drivers relying on affinity masks. This could affect system reliability and efficiency when using affected virtio devices.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for specific kernel warnings related to affinity mask issues in virtio_vdpa. Look for warnings similar to: "WARNING: CPU: ... at lib/group_cpus.c:400 group_cpus_evenly" which indicate the problem described. You can use the command `dmesg | grep -i 'group_cpus_evenly'` or `journalctl -k | grep -i 'group_cpus_evenly'` to find such warnings in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed, as the issue is resolved by conditionally building affinity masks only when the driver passes an affinity descriptor and the parent supports affinity setting config operations. Until then, monitoring for the warning messages and limiting the number of queues to not exceed the number of CPUs for affected devices may help reduce the risk.