CVE-2023-54043: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54043 is a linked list corruption vulnerability in the Linux kernel's iommufd subsystem. The flaw involves a hardware page table (hwpt) being incorrectly added to the ioas->hwpt_list twice, corrupting the linked list in certain scenarios. It affects Linux kernel versions starting from 6.2 up to the patched commits (fixed in stable branches at 6.2.3 and 6.3). The vulnerability was published on December 24, 2025, and carries an EPSS score of approximately 0.018% (very low), with no CVSS base score assigned by ENISA (Feedly, EUVD).

The root cause is a leftover code hunk from a prior rework of the iommufd subsystem that erroneously re-adds an already-registered hwpt to the ioas->hwpt_list during HWPT-specific attachment operations (CWE-415: Double Free / improper list management). When the same hwpt is inserted into the linked list a second time, the list's prev/next pointers become inconsistent, leading to memory corruption. The bug is only reachable via HWPT-specific attachment paths and cannot be triggered through the standard test suite because it requires a legitimate struct device with a non-system IOMMU driver — a configuration not yet supported in the test infrastructure (Feedly). Fixes are available as kernel commits c44adefdcf47 (for one stable branch) and b4ff830eca09 (for another) (Kernel Git, Kernel Git).

Successful triggering of this vulnerability results in kernel-level linked list corruption within the iommufd subsystem, which can lead to unpredictable kernel behavior including system crashes (denial of service) or potential memory safety violations. Because the corruption occurs in kernel memory structures managing IOMMU hardware page tables, there is a theoretical risk of privilege escalation or information disclosure in affected configurations, though practical exploitation is highly constrained by the prerequisite hardware and driver setup. Availability is the most directly impacted property, as kernel panics or instability are the most likely observable outcome (Feedly).

The fix has been applied to the Linux kernel stable tree via commits c44adefdcf472f946f0632f4e0ddcbf3e00b8516 and b4ff830eca097df51af10a9be29e8cc817327919, targeting stable branches at versions 6.2.3 and 6.3 respectively. Administrators running affected kernel versions (6.2.x before 6.2.3, or pre-6.3 kernels with iommufd support) should update to a patched kernel release. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (Kernel Git, Kernel Git).