CVE-2023-54034: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54034 is a Linux kernel vulnerability in the iommufd subsystem where the vfio_iommu_type1_info structure is not properly zero-initialized before being copied to user space. The flaw was published on December 24, 2025, and affects Linux kernel versions starting from the introduction of the vulnerable code (commit d624d6652a65ad4f47a58b8651a1ec1163bb81d3) up to the fixes in the 6.2 and 6.3 stable branches. No CVSS score has been formally assigned by NVD at this time; Feedly estimates the severity as Medium with an EPSS score of 0.00018 (Feedly, NVD).

The root cause is a missing zero initialization of the vfio_iommu_type1_info structure in the iommufd subsystem before it is copied to user space (CWE classification not yet formally assigned by NVD). The structure is partially populated via copy_from_user(), but the minsz parameter used for that copy is 8 bytes smaller than the actual struct size, leaving the trailing padding bytes uninitialized and potentially containing stale kernel memory contents. An attacker with access to the relevant VFIO/IOMMU ioctl interface could read these uninitialized bytes, constituting a kernel memory disclosure. Fixes were applied in two stable kernel commits: 7adcec686e4d699c169d34c722132b2bce5232cb (targeting the 6.2 branch) and b3551ead616318ea155558cdbe7e91495b8d9b33 (targeting the 6.3 branch) (NVD, kernel.org patch 1, kernel.org patch 2).

The primary impact is an information disclosure of uninitialized kernel stack or heap memory to a local user-space process with access to the VFIO/IOMMU ioctl interface. The leaked 8 bytes of padding could contain sensitive kernel data such as pointers, keys, or other residual memory contents, potentially aiding in bypassing kernel address space layout randomization (KASLR) or facilitating further exploitation. Integrity and availability are not directly affected by this vulnerability.

Apply the upstream Linux kernel patches that introduce proper zero initialization of the vfio_iommu_type1_info structure before the copy-to-user operation. The fixes are available in stable commits 7adcec686e4d699c169d34c722132b2bce5232cb (6.2.x branch, patched at 6.2.3) and b3551ead616318ea155558cdbe7e91495b8d9b33 (6.3 branch). Users should update to a patched kernel version incorporating these commits. As a temporary workaround, restricting unprivileged access to VFIO/IOMMU device nodes can reduce exposure (NVD, kernel.org patch 1, kernel.org patch 2).