CVE-2023-54098: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54098 is a NULL pointer dereference vulnerability in the Linux kernel's Intel Graphics Virtualization Technology (GVT-g) debugfs subsystem, specifically in the intel_gvt_debugfs_clean() function within the drm/i915/gvt driver. The flaw occurs when the GVT debugfs is destroyed without first checking whether the DRM minor's debugfs root is still available, leading to a kernel crash when a device is removed via unbinding. It affects Linux kernel versions that include the kvmgt module with the i915 GVT driver. The CVE was published on December 24, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing validity check in intel_gvt_debugfs_clean() (CWE-476: NULL Pointer Dereference). When a device is unbound (e.g., via unbind_store), the DRM minor's debugfs directory is removed before intel_gvt_debugfs_clean() is called, leaving a dangling pointer. The function then attempts to call debugfs_remove() on this stale pointer, which internally calls simple_recursive_removal() → down_write() on address 0x00000000000000a0, triggering a kernel oops. Exploitation requires local access with low-privileged permissions and is triggered by the specific sequence of MDEV device registration followed by unbinding of the i915 GPU (Red Hat Bugzilla).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic (oops) and system crash, impacting availability. There is no confidentiality or integrity impact, as the vulnerability is limited to a denial-of-service condition. The affected scope is limited to systems running the Linux kernel with the kvmgt module and Intel i915 GVT-g GPU virtualization enabled, particularly during device removal or unbinding operations (Red Hat Advisory, Red Hat Bugzilla).

The fix involves adding a validity check in intel_gvt_debugfs_clean() to verify that the DRM minor's debugfs root is still available before attempting removal, preventing the NULL pointer dereference. Patches have been committed to the Linux kernel stable tree (commits ae9a615, b85c853, bb7c7b2, c4b850d). Users should update to the latest patched Linux kernel version provided by their distribution, and Red Hat has tracked the fix via Bugzilla. As a workaround, limiting local user access to device unbinding operations (e.g., restricting write access to sysfs unbind entries) can reduce exposure (Red Hat Bugzilla, Red Hat Advisory).