CVE-2023-53795: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53795 is a race condition vulnerability in the Linux kernel's IOMMUFD subsystem, specifically in the handling of IOMMUFD_DESTROY operations. The flaw causes IOMMUFD_DESTROY to incorrectly increment the object reference count without holding the destroy_rwsem, violating internal locking assumptions and leading to spurious failures or kernel warnings. It was published on December 9, 2025, and affects the Linux kernel. The CVSS category is estimated as Medium, with an EPSS score of 0.000180 (Feedly).

The root cause is a race condition (CWE-362) in the iommufd subsystem of the Linux kernel. When IOMMUFD_DESTROY is called, it invokes iommufd_get_object() followed by iommufd_ref_to_users(), which elevates the object's reference count. This elevation occurs without holding the destroy_rwsem lock, violating the invariant that all temporary reference count elevations must be protected by that semaphore. Racing IOMMUFD_DESTROY with iommufd_object_destroy_user() can trigger a kernel WARNING in drivers/iommu/iommufd/device.c at iommufd_access_destroy, as discovered by the syzkaller fuzzer (Feedly). Fixes are available in the stable kernel tree at commits 99f98a7c0d69 and 495b327435b0 (kernel.org).

Successful exploitation of this race condition can cause spurious kernel warnings and potentially destabilize the IOMMUFD subsystem, affecting systems that rely on IOMMU-based device isolation (e.g., virtualization and device passthrough environments). The primary impact is on system availability and integrity, as the race can lead to incorrect object lifecycle management within the kernel. Confidentiality impact is considered low, as this is a local kernel subsystem issue rather than a direct data exposure vulnerability (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2023-53795. The vulnerability was discovered by the syzkaller kernel fuzzer, indicating it requires local access and specific timing conditions to trigger. The EPSS score is very low at 0.000180, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection coverage exists via Nessus plugin 278096 (Tenable).

• Logs: Kernel warning messages referencing iommufd_access_destroy in drivers/iommu/iommufd/device.c (line 477/478), appearing in dmesg or /var/log/kern.log.
• Process: Unusual or repeated calls to IOMMUFD_DESTROY ioctl from unprivileged or sandboxed processes, potentially visible via strace or audit logs.

Apply the upstream Linux kernel patches available at commits 99f98a7c0d6985d5507c8130a981972e4b7b3bdc and 495b327435b0298e9b3b434f5834d459a93673ce in the stable kernel tree (kernel.org). Distribution-specific updates are available via SUSE (advisory SUSE-2026-20876-1 and SUSE-2026-0281-1) (Linux Security). Users should update to a patched kernel version as provided by their Linux distribution. No configuration-based workaround is known; patching is the recommended remediation.