CVE-2023-54296: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54296 is a NULL pointer dereference vulnerability in the Linux kernel's KVM subsystem, specifically in the AMD SVM (Secure Virtual Machine) implementation for SEV-ES (Secure Encrypted Virtualization - Encrypted State) intrahost migration. The bug causes KVM to incorrectly retrieve source vCPUs from the destination VM instead of the source VM during intrahost migration, leaving the VMSA (VM Save Area) pointer NULL and triggering a host kernel crash. It was published on December 30, 2025, and affects the Linux kernel. The EPSS score is approximately 0.017% (very low), and no CVSS score has been formally assigned at this time (Feedly, CVE.org).

The root cause is an incorrect vCPU source reference during SEV-ES intrahost migration in the KVM SVM subsystem (CWE-476: NULL Pointer Dereference). When performing intrahost migration, the code erroneously fetches vCPUs from the destination VM rather than the source VM, resulting in a NULL VMSA pointer. When the kernel subsequently attempts to dereference this NULL pointer (e.g., in __free_pages()), it triggers a page fault and kernel oops/crash. The crash manifests as a BUG: unable to handle page fault for address at an invalid memory address, as shown in the kernel trace included in the CVE description (Feedly). Fixes are available in the stable kernel tree via commits 2ee4b180d51b, 5c18ace750e4, and f1187ef24eb8 (kernel.org).

Successful triggering of this vulnerability causes a host kernel crash (denial of service), as the NULL VMSA pointer dereference results in an unrecoverable kernel oops. This affects the availability of the entire host system running AMD SEV-ES workloads with KVM, potentially impacting all guest VMs on that host. Because the vulnerability is in the hypervisor layer, a malicious or buggy guest performing intrahost migration could crash the host, affecting all co-located tenants in a cloud or virtualized environment (Feedly).

Apply the upstream Linux kernel patches that correct the vCPU source reference during SEV-ES intrahost migration. The fixes are available in the stable kernel tree via commits 2ee4b180d51b12a45bdd3264629719ef6a572a73, 5c18ace750e4d4d58d7da02d1c669bf21c824158, and f1187ef24eb8f36e8ad8106d22615ceddeea6097. Administrators running AMD SEV-ES workloads with KVM should update to a patched kernel version as soon as their distribution provides one. As a temporary workaround, disabling SEV-ES intrahost migration (if operationally feasible) would prevent triggering the vulnerable code path (kernel.org).