CVE-2023-53501

iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

4.7 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

When unbinding pasid - a race condition exists vs outstanding page faults.

To prevent this, the pasid_state object contains a refcount. * set to 1 on pasid bind * incremented on each ppr notification start * decremented on each ppr notification done * decremented on pasid unbind

Since refcount_dec assumes that refcount will never reach 0: the current implementation causes the following to be invoked on pasid unbind: REFCOUNT_WARN("decrement hit 0; leaking memory")

Fix this issue by changing refcount_dec to refcount_dec_and_test to explicitly handle refcount=1.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.15%Up 0.1 points since Oct 1, 2025

What each source reports

NVD Score used4.7

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

When unbinding pasid - a race condition exists vs outstanding page faults.

Since refcount_dec assumes that refcount will never reach 0: the current implementation causes the following to be invoked on pasid unbind: REFCOUNT_WARN("decrement hit 0; leaking memory")

Fix this issue by changing refcount_dec to refcount_dec_and_test to explicitly handle refcount=1.

Record: CVE-2023-53501
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

CVE ListNo score

iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

When unbinding pasid - a race condition exists vs outstanding page faults.

Since refcount_dec assumes that refcount will never reach 0: the current implementation causes the following to be invoked on pasid unbind: REFCOUNT_WARN("decrement hit 0; leaking memory")

Fix this issue by changing refcount_dec to refcount_dec_and_test to explicitly handle refcount=1.

Record: CVE-2023-53501
Updated: 2026-11-02

EUVDEUVD-2025-32777No score

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

When unbinding pasid - a race condition exists vs outstanding page faults.

Since refcount_dec assumes that refcount will never reach 0: the current implementation causes the following to be invoked on pasid unbind: REFCOUNT_WARN("decrement hit 0; leaking memory")

Fix this issue by changing refcount_dec to refcount_dec_and_test to explicitly handle refcount=1.

Record: EUVD-2025-32777
Updated: 2026-11-02

GitHub AdvisoriesGHSA-76q6-633x-65vj4.7

In the Linux kernel, the following vulnerability has been resolved: iommu/amd/iommu_v2: Fix...

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

When unbinding pasid - a race condition exists vs outstanding page faults.

Since refcount_dec assumes that refcount will never reach 0: the current implementation causes the following to be invoked on pasid unbind: REFCOUNT_WARN("decrement hit 0; leaking memory")

Fix this issue by changing refcount_dec to refcount_dec_and_test to explicitly handle refcount=1.

Record: GHSA-76q6-633x-65vj
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2023-535014.7

Record: BELL-CVE-2023-53501
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-535014.7

In the Linux kernel, the following vulnerability has been resolved: iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind When unbinding pasid - a race condition exists vs outstanding page faults. To prevent this, the pasid_state object contains a refcount. * set to 1 on pasid bind * incremented on each ppr notification start * decremented on each ppr notification done * decremented on pasid unbind Since refcount_dec assumes that refcount will never reach 0: the current implementation causes the following to be invoked on pasid unbind: REFCOUNT_WARN("decrement hit 0; leaking memory") Fix this issue by changing refcount_dec to refcount_dec_and_test to explicitly handle refcount=1.

Record: DEBIAN-CVE-2023-53501
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 16 moreShow less

OSVRHSA-2024:23947.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2024:2394
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:31388.0

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2024:3138
CVSS 3.1: 8.0 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Updated: 2026-11-02

OSVRXSA-2024:31388.0

Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux SIG Cloud 8.10 Release Notes linked from the References section.

Record: RXSA-2024:3138
CVSS 3.1: 8.0 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-535016.7

Record: UBUNTU-CVE-2023-53501
CVSS 4.0: 6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVCLSA-2026-1782151303No score

kernel: Fix of 151 CVEs

spi: spi-fsl-lpspi: fix teardown order issue (UAF) {CVE-2026-31485}
Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419}
bonding: do not set usable_slaves for broadcast mode {CVE-2026-31419}
net: bonding: update the slave array for broadcast mode {CVE-2026-31419}
dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
net: Fix an unsafe loop on the list {CVE-2024-50024}
sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy {CVE-2025-21636}
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx {CVE-2023-54300}
wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream {CVE-2024-49913}
xfrm: validate new SA's prefixlen using SA family when sel.family is unset {CVE-2024-50142}
serial: imx: Introduce timeout when waiting on transmitter empty {CVE-2024-40967}
iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind {CVE-2023-53501}
octeontx2-af: Add validation before accessing cgx and lmac {CVE-2023-53654}
sctp: sysctl: rto_min/max: avoid using current->nsproxy {CVE-2025-21639}
net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices {CVE-2023-52984}
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start {CVE-2024-49944}
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451}
thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR {CVE-2022-48703}
x86/mm: Fix pti_clone_pgtable() alignment assumption {CVE-2024-44965}
net: usb: asix_devices: add phy_mask for ax88772 mdio bus {CVE-2025-38725}
ALSA: hda: Do not unset preset when cleaning up codec {CVE-2023-52736}
drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func {CVE-2024-49909}
Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE {CVE-2024-53144}
fuse: Initialize beyond-EOF page contents before setting uptodate {CVE-2024-44947}
sctp: sysctl: udp_port: avoid using current->nsproxy {CVE-2025-21637}
dm stats: check for and propagate alloc_percpu failure {CVE-2023-53044}
netpoll: Fix race condition in netpoll_owner_active {CVE-2024-41005}
tracing: Fix overflow in get_free_elt() {CVE-2024-43890}
mm/slub: avoid accessing metadata when pointer is invalid in object_err() {CVE-2025-39902}
xen/netfront: stop tx queues during live migration {CVE-2022-48969}
Bluetooth: btusb: clamp SCO altsetting table indices {CVE-2026-31497}
ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free {CVE-2025-38105}
can: j1939: make j1939_sk_bind() fail if device is no longer registered {CVE-2025-39925}
nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() {CVE-2023-52508}
smb: client: Don't log plaintext credentials in cifs_set_cifscreds {CVE-2026-23303}
cifs: Fix integer overflow while processing acdirmax mount option {CVE-2025-21963}
netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416}
drm/amdgpu/vkms: fix a possible null pointer dereference {CVE-2023-52815}
drm/amd/amdgpu: Check tbo resource pointer {CVE-2024-46807}
bonding: fix null pointer deref in bond_ipsec_offload_ok {CVE-2024-44990}
wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower {CVE-2024-50237}
trace_events_hist: add check for return value of 'create_hist_field' {CVE-2023-53005}
drm/amdkfd: Add sync after creating vram bo {CVE-2023-53009}
bpf: Send signals asynchronously if !preemptible {CVE-2025-21728}
drm/client: fix null pointer dereference in drm_client_modeset_probe {CVE-2024-43894}
ext4: correct grp validation in ext4_mb_good_group {CVE-2023-53861}
RDMA/irdma: Initialize…

Record: CLSA-2026-1782151303
Updated: 2026-11-02

OSVNo score

iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

When unbinding pasid - a race condition exists vs outstanding page faults.

Since refcount_dec assumes that refcount will never reach 0: the current implementation causes the following to be invoked on pasid unbind: REFCOUNT_WARN("decrement hit 0; leaking memory")

Fix this issue by changing refcount_dec to refcount_dec_and_test to explicitly handle refcount=1.

Record: CVE-2023-53501
Updated: 2026-11-02

OSVSUSE-SU-2025:03600-1No score