CVE-2023-52484— iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于内核线程使用和不释放 CPU 的时间超过规定时间。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 51d113c3be09ff5b916576b1109daf413549cacc< f5a604757aa8e37ea9c7011dc9da54fa1b30f29b |
affected |
51d113c3be09ff5b916576b1109daf413549cacc< f90f4c562003ac3d3b135c5a40a5383313f27264 |
affected | ||
51d113c3be09ff5b916576b1109daf413549cacc< 3283a1bce9bbc978059f790b84f3c10c32492429 |
affected | ||
51d113c3be09ff5b916576b1109daf413549cacc< d5afb4b47e13161b3f33904d45110f9e6463bad6 |
affected | ||
5.12 |
affected | ||
< 5.12 |
unaffected | ||
5.15.134≤ 5.15.* |
unaffected | ||
6.1.56≤ 6.1.* |
unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-52484
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
When running an SVA case, the following soft lockup is triggered:
--------------------------------------------------------------------
watchdog: BUG: soft lockup - CPU#244 stuck for 26s!
pstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : arm_smmu_cmdq_issue_cmdlist+0x178/0xa50
lr : arm_smmu_cmdq_issue_cmdlist+0x150/0xa50
sp : ffff8000d83ef290
x29: ffff8000d83ef290 x28: 000000003b9aca00 x27: 0000000000000000
x26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: 0000000000000000
x23: 0000000000000040 x22: ffff8000d83ef340 x21: ffff0000c63980c0
x20: 0000000000000001 x19: ffff0000c6398080 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: ffff3000b4a3bbb0
x14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc08120e4d6bc
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000048cfa
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 000000000000000a
x2 : 0000000080000000 x1 : 0000000000000000 x0 : 0000000000000001
Call trace:
arm_smmu_cmdq_issue_cmdlist+0x178/0xa50
__arm_smmu_tlb_inv_range+0x118/0x254
arm_smmu_tlb_inv_range_asid+0x6c/0x130
arm_smmu_mm_invalidate_range+0xa0/0xa4
__mmu_notifier_invalidate_range_end+0x88/0x120
unmap_vmas+0x194/0x1e0
unmap_region+0xb4/0x144
do_mas_align_munmap+0x290/0x490
do_mas_munmap+0xbc/0x124
__vm_munmap+0xa8/0x19c
__arm64_sys_munmap+0x28/0x50
invoke_syscall+0x78/0x11c
el0_svc_common.constprop.0+0x58/0x1c0
do_el0_svc+0x34/0x60
el0_svc+0x2c/0xd4
el0t_64_sync_handler+0x114/0x140
el0t_64_sync+0x1a4/0x1a8
--------------------------------------------------------------------
Note that since 6.6-rc1 the arm_smmu_mm_invalidate_range above is renamed
to "arm_smmu_mm_arch_invalidate_secondary_tlbs", yet the problem remains.
The commit 06ff87bae8d3 ("arm64: mm: remove unused functions and variable
protoypes") fixed a similar lockup on the CPU MMU side. Yet, it can occur
to SMMU too, since arm_smmu_mm_arch_invalidate_secondary_tlbs() is called
typically next to MMU tlb flush function, e.g.
tlb_flush_mmu_tlbonly {
tlb_flush {
__flush_tlb_range {
// check MAX_TLBI_OPS
}
}
mmu_notifier_arch_invalidate_secondary_tlbs {
arm_smmu_mm_arch_invalidate_secondary_tlbs {
// does not check MAX_TLBI_OPS
}
}
}
Clone a CMDQ_MAX_TLBI_OPS from the MAX_TLBI_OPS in tlbflush.h, since in an
SVA case SMMU uses the CPU page table, so it makes sense to align with the
tlbflush code. Then, replace per-page TLBI commands with a single per-asid
TLBI command, if the request size hits this threshold.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于内核线程使用和不释放 CPU 的时间超过规定时间。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-52484
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-52484
请登录查看更多情报信息。
Other References for CVE-2023-52484 (4)
Same Patch Batch · Linux · 2024-02-29 · 53 CVEs total
| CVE-2023-52480 | 9.8 CRITICAL | ksmbd: fix race condition between session lookup and expire |
| CVE-2023-52478 | 8.8 HIGH | HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect |
| CVE-2023-52479 | 8.8 HIGH | ksmbd: fix uaf in smb20_oplock_break_ack |
| CVE-2024-26620 | 8.2 HIGH | s390/vfio-ap: always filter entire AP matrix |
| CVE-2021-47061 | 7.8 HIGH | KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU |
| CVE-2023-52486 | 7.8 HIGH | drm: Don't unref the same fb many times by mistake due to deadlock handling |
| CVE-2023-52483 | 7.8 HIGH | mctp: perform route lookups under a RCU read-side lock |
| CVE-2021-47068 | 7.8 HIGH | net/nfc: fix use-after-free llcp_sock_bind/connect |
| CVE-2023-52491 | 7.8 HIGH | media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_ |
| CVE-2021-47060 | 7.8 HIGH | KVM: Stop looking for coalesced MMIO zones if the bus is destroyed |
| CVE-2024-26608 | 7.8 HIGH | ksmbd: fix global oob in ksmbd_nl_policy |
| CVE-2024-26610 | 7.8 HIGH | wifi: iwlwifi: fix a memory corruption |
| CVE-2024-26614 | 7.8 HIGH | tcp: make sure init the accept_queue's spinlocks once |
| CVE-2024-26617 | 7.8 HIGH | fs/proc/task_mmu: move mmu notification mechanism inside mm lock |
| CVE-2024-26611 | 7.5 HIGH | xsk: fix usage of multi-buffer BPF helpers for ZC XDP |
| CVE-2023-52497 | 7.1 HIGH | erofs: fix lz4 inplace decompression |
| CVE-2021-47066 | 7.1 HIGH | async_xor: increase src_offs when dropping destination page |
| CVE-2021-47055 | 7.1 HIGH | mtd: require write permissions for locking and badblock ioctls |
| CVE-2021-47063 | drm: bridge/panel: Cleanup connector on bridge detach | |
| CVE-2021-47016 | m68k: mvme147,mvme16x: Don't wipe PCC timer config bits |
Showing top 20 of 53 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2023-52484
No comments yet