CVE-2023-53647: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability has been identified in the Linux kernel's VMBus client driver (CVE-2023-53647). The issue involves improper handling of ACPI namespace root object references when walking the ACPI namespace to find Hyper-V MMIO ranges (NVD).

The vulnerability occurs when the VMBus client driver walks the ACPI namespace up from the VMBus ACPI device to the ACPI namespace root object searching for Hyper-V MMIO ranges. If these ranges are not found, the driver attempts to walk resources of the ACPI namespace root object itself. This object has an all-ones handle, which results in a NULL pointer dereference in the ACPI code when attempting to dereference this pointer with an offset. The issue specifically affects Linux guests under KVM/QEMU when the Hyper-V PV interface is used (NVD).

When triggered, this vulnerability causes a system crash (oops) on boot with VMBus host implementations that do not provide Hyper-V MMIO ranges in their VMBus ACPI device or its ancestors. The QEMU VMBus implementation is specifically noted as an example of such an implementation (NVD).

The issue has been resolved by explicitly terminating the lookup at the ACPI namespace root object. This prevents the attempt to dereference the invalid root object handle (NVD).