CVE-2023-54060: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54060 is a NULL pointer dereference vulnerability in the Linux kernel's iommufd subsystem, specifically in the batch carry logic of the IOMMU file descriptor interface. The flaw arises from an incorrect end value assignment during batch carry operations, which can cause a kernel NULL pointer dereference under certain conditions. It was published on December 24, 2025, and affects the Linux kernel. The CVSS score and severity rating have not been publicly assigned at this time (Feedly, CVE.org).

The root cause is an off-by-one error (CWE-193) in the iommufd batch carry logic: when a carry item is pushed to the pfns list, the end variable is not correctly set to 1, leaving it at an incorrect value. This causes the batch_unpin() function to dereference a NULL pointer when iterating over the batch list, as demonstrated by the kernel oops trace showing a NULL dereference at batch_unpin+0xa2/0x100 in the iommufd module. The vulnerability is triggered by the iommufd_ioas.mock_domain.access_domain_destroy test case, which could blow up intermittently in affected kernel versions. Exploitation requires local access to trigger the iommufd subsystem operations (Feedly, CVE.org).

Successful exploitation of this vulnerability results in a kernel NULL pointer dereference, causing a system crash (kernel panic/oops) and denial of service. The affected component is the iommufd subsystem, which is used for managing IOMMU (Input-Output Memory Management Unit) file descriptors, typically relevant in virtualization and device passthrough scenarios. There is no evidence of confidentiality or integrity impact beyond availability loss (Feedly).

The fix is available in the Linux kernel stable tree via commits 176f36a376c4 and b7c822fa6b77, which correctly set end to 1 after pushing the carry item to the pfns list. Users should update to a patched kernel version that includes these fixes. SUSE has issued advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1) incorporating the fix for affected SUSE Linux Enterprise kernel packages (Feedly, Linux Security SUSE Advisory).