CVE-2023-54095: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54095 is a Linux kernel vulnerability in the PowerPC IOMMU subsystem where fail_iommu_setup() incorrectly registers the same notifier_block struct to both PCI and VIO buses, causing notifier linked lists to be shared between bus types. This results in notifiers registered for one bus type (e.g., PCI) being inadvertently called for devices on the other bus type (e.g., VIO), leading to invalid type casts and out-of-bounds memory accesses. The vulnerability affects the Linux kernel on PowerPC/pseries platforms. It was published on December 24, 2025, and detected by Qualys scanners (Feedly). No CVSS score has been officially assigned at this time.

The root cause is improper sharing of a struct notifier_block linked list node between PCI and VIO bus notifier chains in the PowerPC IOMMU fail_iommu_setup() function (CWE-762: Incompatible Methods for Acquiring/Releasing Resource). Because struct notifier_block is a linked list node, registering the same instance to two different bus types causes subsequent notifier registrations to propagate across both chains. This means the VGA arbiter's pci_notify() callback — registered only for PCI buses — gets invoked on VIO devices, which are then incorrectly cast via to_pci_dev(). The resulting invalid pointer dereference triggers a KASAN-detected slab-out-of-bounds read in vga_arbiter_add_pci_device() at offset +0x60/0xe00 (Feedly).

Successful triggering of this vulnerability causes a kernel slab-out-of-bounds read, which can lead to a kernel panic or system crash, impacting availability on affected PowerPC/pseries systems. The out-of-bounds memory access occurs during early boot (device registration phase), meaning it can render the system unbootable or unstable. While the primary impact is availability (denial of service via kernel crash), the out-of-bounds read could theoretically expose sensitive kernel memory contents, posing a limited confidentiality risk (Feedly).

• Logs: Kernel logs containing BUG: KASAN: slab-out-of-bounds in vga_arbiter_add_pci_device during system boot on PowerPC/pseries systems.
• Logs: Kernel stack traces referencing pci_notify, notifier_call_chain, blocking_notifier_call_chain, device_add, vio_register_device_node, or vio_bus_scan_register_devices in the context of a KASAN report.
• Logs: Kernel panic or oops messages during early boot (kernel_init_freeable / do_one_initcall phase) on affected hardware.

The Linux kernel maintainers have issued fixes across multiple stable branches, with patches available at the following kernel.org stable commits: 65bf8a196ba2, 075a4dcdbc9a, 6670c65bf863, a9ddbfed5346, and c37b6908f7b2. Administrators running PowerPC/pseries systems should update to a patched kernel version that includes these fixes. Red Hat has also tracked this issue (RH:CVE-2023-54095), so users of RHEL on PowerPC should apply available errata. No configuration-based workaround is known; kernel upgrade is the recommended remediation (Feedly).