CVE-2023-54089: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54089 is a Linux kernel vulnerability in the virtio_pmem subsystem caused by a missing REQ_OP_WRITE flag in flush bio operations on persistent memory (pmem) devices. The flaw was publicly disclosed on December 24, 2025, and affects Linux kernel versions from commit b4a6bb3a67aa0c37b2b6cd47efc326eb455de674 up to the patched releases in stable branches 6.4.16, 6.5.3, and 6.6. It was assigned a CVSS v3.1 base score of 7.0 (High) with a local attack vector and low privilege requirement (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an omission in async_pmem_flush() within the virtio_pmem driver: when allocating a flush bio, the function fails to set the REQ_OP_WRITE operation flag. The submit_bio_noacct() function enforces that flush bio operations must have bio_op() set to either WRITE or ZONE_APPEND; without this flag, the flush bio is rejected, triggering a kernel WARN_ON at block/blk-core.c:751. This manifests as a kernel warning during operations like mkfs.xfs on a virtio pmem device in a QEMU virtualized environment. The issue is classified under improper handling of I/O operations (related to CWE-754: Improper Check for Unusual or Exceptional Conditions). The fix adds the missing REQ_OP_WRITE flag in the bio allocation within async_pmem_flush() (Red Hat Bugzilla, Feedly).

Exploitation of this vulnerability can cause I/O flush operations to fail silently or with kernel warnings on systems using virtio_pmem persistent memory devices, potentially leading to data integrity issues and system instability during write-flush cycles. The failure of flush bio operations may result in data not being properly committed to persistent storage, risking data loss or corruption. The scope is limited to systems running affected Linux kernel versions with virtio_pmem devices (typically QEMU/KVM virtualized environments), and there is no known path to remote code execution or lateral movement (Red Hat Advisory, Feedly).

The fix has been applied to Linux kernel stable branches: version 6.4.16, 6.5.3, and 6.6 (and later). Administrators should update to the latest stable kernel version that includes the patch commits e39e870e1e683a71d3d2e63e661a5695f60931a7, c7ab7e45ccef209809f8c2b00f497deec06b29c0, or c1dbd8a849183b9c12d257ad3043ecec50db50b3 depending on their branch. Vendor-specific patches (e.g., SUSE kernel updates) are also available. Systems not using virtio_pmem persistent memory devices are not affected and require no action (Red Hat Bugzilla, Feedly).

Red Hat tracked the issue via Bugzilla and assigned it medium severity, with the upstream advisory published via the Linux kernel CVE announcement mailing list (lore.kernel.org). SUSE issued a kernel security advisory (SUSE-2026-0281-1) addressing this and related CVEs. No significant broader community or social media discussion has been observed beyond standard kernel security tracking channels (Red Hat Bugzilla).