CVE-2023-54024

KVM: Destroy target device if coalesced MMIO unregistration fails

State: Published
Severity: Not scored
Published: Dec 24, 2025
Updated: May 23, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: Destroy target device if coalesced MMIO unregistration fails

Destroy and free the target coalesced MMIO device if unregistering said device fails. As clearly noted in the code, kvm_io_bus_unregister_dev() does not destroy the target device.

BUG: memory leak unreferenced object 0xffff888112a54880 (size 64): comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s) hex dump (first 32 bytes): 38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff 8.g.....8.g..... e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff .........0g..... backtrace: [<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline] [<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline] [<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150 [<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323 [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline] [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline] [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696 [<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713 [<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline] [<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline] [<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718 [<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290 [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe

BUG: leak checking failed

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7d1bc32d6477ff96a32695ea4be8144e4513ab2d to before 10c2a20d73e99463e69b7e92706791656adc16d7Affected 2a20592baff59c5351c5200ec667e1a2aa22af85 to before 76a9886e1b61ce5592df5ae78a19ed30399ae189Affected 5d3c4c79384af06e3c8e25b7770b6247496b4417 to before 999439fd5da5a76253e2f2c37b94204f47d75491Affected 5d3c4c79384af06e3c8e25b7770b6247496b4417 to before ccf6a7fb1aedb1472e1241ee55e4d26b68f8d066Affected 5d3c4c79384af06e3c8e25b7770b6247496b4417 to before fb436dd6914325075f07d19851ab277b7a693ae7Affected 5d3c4c79384af06e3c8e25b7770b6247496b4417 to before b1cb1fac22abf102ffeb29dd3eeca208a3869d54Affected 168e82f640ed1891a700bdb43e37da354b2ab63cAffected 50cbad42bfea8c052b7ca590bd4126cdc898713cAffected 5.4.119 to before 5.4.235Affected 5.10.37 to before 5.10.173Affected 5.11.21 to before 5.12Affected 5.12.4 to before 5.13Affected
LinuxLinux	5.13Affected before 5.13Not affected 5.4.235 through 5.4.Not affected 5.10.173 through 5.10.Not affected 5.15.99 through 5.15.Not affected 6.1.16 through 6.1.Not affected 6.2.3 through 6.2.*Not affected 6.3 and laterNot affected

Product

Versions

LinuxLinux

7d1bc32d6477ff96a32695ea4be8144e4513ab2d to before 10c2a20d73e99463e69b7e92706791656adc16d7Affected
2a20592baff59c5351c5200ec667e1a2aa22af85 to before 76a9886e1b61ce5592df5ae78a19ed30399ae189Affected
5d3c4c79384af06e3c8e25b7770b6247496b4417 to before 999439fd5da5a76253e2f2c37b94204f47d75491Affected
5d3c4c79384af06e3c8e25b7770b6247496b4417 to before ccf6a7fb1aedb1472e1241ee55e4d26b68f8d066Affected
5d3c4c79384af06e3c8e25b7770b6247496b4417 to before fb436dd6914325075f07d19851ab277b7a693ae7Affected
5d3c4c79384af06e3c8e25b7770b6247496b4417 to before b1cb1fac22abf102ffeb29dd3eeca208a3869d54Affected
168e82f640ed1891a700bdb43e37da354b2ab63cAffected
50cbad42bfea8c052b7ca590bd4126cdc898713cAffected
5.4.119 to before 5.4.235Affected
5.10.37 to before 5.10.173Affected
5.11.21 to before 5.12Affected
5.12.4 to before 5.13Affected

LinuxLinux

5.13Affected
before 5.13Not affected
5.4.235 through 5.4.*Not affected
5.10.173 through 5.10.*Not affected
5.15.99 through 5.15.*Not affected
6.1.16 through 6.1.*Not affected
6.2.3 through 6.2.*Not affected
6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.