vmci_host: fix a race condition in vmci_host_poll() causing GPF

{
  "id": "d857553c042f89e8e4a3289b22f95108a1f811b6f9ec83271a76b765ed69220d",
  "url": "https://osv.dev/vulnerability/CVE-2023-54007",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "vmci_host: fix a race condition in vmci_host_poll() causing GPF",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: vmci_host: fix a race condition in vmci_host_poll() causing GPF During fuzzing, a general protection fault is observed in vmci_host_poll(). general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926 <- omitting registers -> Call Trace: lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162 add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22 poll_wait include/linux/poll.h:49 [inline] vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174 vfs_poll include/linux/poll.h:88 [inline] do_pollfd fs/select.c:873 [inline] do_poll fs/select.c:921 [inline] do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015 __do_sys_ppoll fs/select.c:1121 [inline] __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Example thread interleaving that causes the general protection fault is as follows: CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context) ----- ----- // Read uninitialized context context = vmci_host_dev->context; // Initialize context vmci_host_dev->context = vmci_ctx_create(); vm",
    "evidence": "osv:CVE-2023-54007",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.19.283",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.4.243",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.10.180",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.111",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.28",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.2.15",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.3.2",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2023-54007",
      "aliases": [
        "CVE-2023-54007"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "8bf503991f87e32ea42a7bd69b79ba084fddc5d7"
                },
                {
                  "fixed": "2053e93ac15519ed1f1fe6eba79a33a4963be4a3"
                },
                {
                  "fixed": "ca0f4ad2b7a36c799213ef0a213eb977a51e03dc"
                },
                {
                  "fixed": "85b4aa4eb2e3a0da111fd0a1cdbf00f986ac6b6b"
                },
                {
                  "fixed": "770d30b1355c6c8879973dd054fca9168def182c"
                },
                {
                  "fixed": "d22b2a35729cb1de311cb650cd67518a24e13fc9"
                },
                {
                  "fixed": "67e35824f861a05b44b19d38e16a83f653bd9d92"
                },
                {
                  "fixed": "ab64bd32b9fac27ff4737d63711b9db5e5462448"
                },
                {
                  "fixed": "ae13381da5ff0e8e084c0323c3cc0a945e43e9c7"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54007.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "3.9.0"
                },
                {
                  "fixed": "4.19.283"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.20.0"
                },
                {
                  "fixed": "5.4.243"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.5.0"
                },
                {
                  "fixed": "5.10.180"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.111"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.28"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.2.15"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.3.0"
                },
                {
                  "fixed": "6.3.2"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54007.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.346959093Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/2053e93ac15519ed1f1fe6eba79a33a4963be4a3",
        "https://git.kernel.org/stable/c/67e35824f861a05b44b19d38e16a83f653bd9d92",
        "https://git.kernel.org/stable/c/770d30b1355c6c8879973dd054fca9168def182c",
        "https://git.kernel.org/stable/c/85b4aa4eb2e3a0da111fd0a1cdbf00f986ac6b6b",
        "https://git.kernel.org/stable/c/ab64bd32b9fac27ff4737d63711b9db5e5462448",
        "https://git.kernel.org/stable/c/ae13381da5ff0e8e084c0323c3cc0a945e43e9c7",
        "https://git.kernel.org/stable/c/ca0f4ad2b7a36c799213ef0a213eb977a51e03dc",
        "https://git.kernel.org/stable/c/d22b2a35729cb1de311cb650cd67518a24e13fc9",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54007.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-54007",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54007.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-54007",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 522339,
  "published_at": "2025-12-24T10:55:41.281+00:00"
}