CVE-2023-54008: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54008 is a vulnerability in the Linux kernel's virtio_vdpa subsystem related to unconditional construction of CPU affinity masks. The flaw causes a kernel warning (WARN_ON) when the number of virtio queues exceeds the number of available CPUs — a condition common in networking devices — because group_cpus_evenly() assumes the number of CPUs is not less than the number of groups. Affected software is the Linux kernel across multiple stable branches, with fixes applied to several stable trees. The vulnerability was published on December 24, 2025, and carries an EPSS score of 0.017% (very low), indicating minimal exploitation probability (Feedly, CVE.org).

The root cause is improper conditional logic in virtio_vdpa (CWE-20: Improper Input Validation / incorrect precondition handling): the function create_affinity_masks() is called unconditionally regardless of whether the parent device supports affinity configuration or whether the driver provides an affinity descriptor. When a networking virtio device is initialized with more queues than CPUs, group_cpus_evenly() triggers a WARN_ON assertion at lib/group_cpus.c:400 because its internal invariant (nr_present + nr_others >= numgrps) is violated. The fix restricts affinity mask construction to cases where the driver explicitly passes an affinity descriptor and the parent device supports the affinity setting config ops (Feedly). Patches are available in the stable kernel trees at commits 5f2592243ccd, 628b53fc66ca, and ae15aceaa98a (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3).

Exploitation of this vulnerability results in a kernel warning being triggered, which in certain kernel configurations (e.g., panic_on_warn) could lead to a kernel panic and denial of service. The primary impact is on availability — specifically for systems running virtio networking devices via VDPA where the queue count exceeds the CPU count. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

Apply the upstream Linux kernel patches that conditionally build affinity masks only when the driver provides an affinity descriptor and the parent device supports affinity setting config ops. Patches have been merged into multiple stable kernel branches (commits 5f2592243ccd, 628b53fc66ca, ae15aceaa98a). SUSE has issued advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1) incorporating these fixes (Linux Security SUSE advisory 1, Linux Security SUSE advisory 2). As a workaround, administrators can limit the number of virtio queues on networking devices to not exceed the number of available CPUs until a patched kernel is deployed.