CVE-2023-52516: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52516 affects the Linux kernel's DMA debugging functionality. The vulnerability was discovered in the way __dma_entry_alloc_check_leak() function is called under free_entries_lock spin lock, which creates a potential deadlock condition. The issue affects Linux kernel versions up to 5.10.198, from 5.11 to 5.15.134, from 5.16 to 6.1.56, and from 6.2 to 6.5.6 (NVD).

The vulnerability stems from a locking dependency chain issue where __dma_entry_alloc_check_leak() calls into printk -> serial console output (qcom geni) and acquires port->lock while holding free_entries_lock spin lock. This creates a reverse locking dependency chain as the qcom_geni IRQ handler can call into dma-debug code and grab free_entries_lock under port->lock. The CVSS v3.1 base score is 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a deadlock condition in the Linux kernel when using DMA debugging features with serial consoles that use DMA. This could potentially cause system hangs or denial of service conditions (Kernel Patch).

The vulnerability requires local access with low privileges to trigger. It specifically affects systems using DMA debugging features in combination with serial consoles that use DMA, particularly with QCOM Geni serial drivers (NVD).

The issue has been fixed by moving the __dma_entry_alloc_check_leak() call out of the free_entries_lock scope to prevent acquiring the serial console's port->lock under it. The fix is available in the kernel patch fb5a4315591dae307a65fc246ca80b5159d296e1 (Kernel Patch).