CVE-2023-53319 in Linux
Summary
by MITRE • 09/16/2025
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Handle kvm_arm_init failure correctly in finalize_pkvm
Currently there is no synchronisation between finalize_pkvm() and kvm_arm_init() initcalls. The finalize_pkvm() proceeds happily even if kvm_arm_init() fails resulting in the following warning on all the CPUs and eventually a HYP panic:
| kvm [1]: IPA Size Limit: 48 bits
| kvm [1]: Failed to init hyp memory protection
| kvm [1]: error initializing Hyp mode: -22
| | <snip> | | WARNING: CPU: 0 PID: 0 at arch/arm64/kvm/pkvm.c:226 _kvm_host_prot_finalize+0x30/0x50 | Modules linked in: | CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0 #237 | Hardware name: FVP Base RevC (DT) | pstate: 634020c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) | pc : _kvm_host_prot_finalize+0x30/0x50 | lr : __flush_smp_call_function_queue+0xd8/0x230 | | Call trace: | _kvm_host_prot_finalize+0x3c/0x50 | on_each_cpu_cond_mask+0x3c/0x6c | pkvm_drop_host_privileges+0x4c/0x78 | finalize_pkvm+0x3c/0x5c | do_one_initcall+0xcc/0x240 | do_initcall_level+0x8c/0xac | do_initcalls+0x54/0x94 | do_basic_setup+0x1c/0x28 | kernel_init_freeable+0x100/0x16c | kernel_init+0x20/0x1a0 | ret_from_fork+0x10/0x20 | Failed to finalize Hyp protection: -22 | dtb=fvp-base-revc.dtb | kvm [95]: nVHE hyp BUG at: arch/arm64/kvm/hyp/nvhe/mem_protect.c:540!
| kvm [95]: nVHE call trace:
| kvm [95]: [<ffff800081052984>] __kvm_nvhe_hyp_panic+0xac/0xf8
| kvm [95]: [<ffff800081059644>] __kvm_nvhe_handle_host_mem_abort+0x1a0/0x2ac
| kvm [95]: [<ffff80008105511c>] __kvm_nvhe_handle_trap+0x4c/0x160
| kvm [95]: [<ffff8000810540fc>] __kvm_nvhe___skip_pauth_save+0x4/0x4
| kvm [95]: ---[ end nVHE call trace ]---
| kvm [95]: Hyp Offset: 0xfffe8db00ffa0000
| Kernel panic - not syncing: HYP panic: | PS:a34023c9 PC:0000f250710b973c ESR:00000000f2000800 | FAR:ffff000800cb00d0 HPFAR:000000000880cb00 PAR:0000000000000000 | VCPU:0000000000000000 | CPU: 3 PID: 95 Comm: kworker/u16:2 Tainted: G W 6.4.0 #237 | Hardware name: FVP Base RevC (DT) | Workqueue: rpciod rpc_async_schedule | Call trace: | dump_backtrace+0xec/0x108 | show_stack+0x18/0x2c | dump_stack_lvl+0x50/0x68 | dump_stack+0x18/0x24 | panic+0x138/0x33c | nvhe_hyp_panic_handler+0x100/0x184 | new_slab+0x23c/0x54c | ___slab_alloc+0x3e4/0x770 | kmem_cache_alloc_node+0x1f0/0x278 | __alloc_skb+0xdc/0x294 | tcp_stream_alloc_skb+0x2c/0xf0 | tcp_sendmsg_locked+0x3d0/0xda4 | tcp_sendmsg+0x38/0x5c | inet_sendmsg+0x44/0x60 | sock_sendmsg+0x1c/0x34 | xprt_sock_sendmsg+0xdc/0x274 | xs_tcp_send_request+0x1ac/0x28c | xprt_transmit+0xcc/0x300 | call_transmit+0x78/0x90 | __rpc_execute+0x114/0x3d8 | rpc_async_schedule+0x28/0x48 | process_one_work+0x1d8/0x314 | worker_thread+0x248/0x474 | kthread+0xfc/0x184 | ret_from_fork+0x10/0x20 | SMP: stopping secondary CPUs | Kernel Offset: 0x57c5cb460000 from 0xffff800080000000 | PHYS_OFFSET: 0x80000000 | CPU features: 0x00000000,1035b7a3,ccfe773f | Memory Limit: none | ---[ end Kernel panic - not syncing: HYP panic:
| PS:a34023c9 PC:0000f250710b973c ESR:00000000f2000800 | FAR:ffff000800cb00d0 HPFAR:000000000880cb00 PAR:0000000000000000 | VCPU:0000000000000000 ]---
Fix it by checking for the successfull initialisation of kvm_arm_init() in finalize_pkvm() before proceeding any futher.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/27/2025
The vulnerability described in CVE-2023-53319 resides within the Linux kernel's KVM implementation for arm64 architecture, specifically concerning the interaction between the kvm_arm_init() and finalize_pkvm() initialization functions. This flaw manifests as a lack of proper synchronization between these two critical initialization routines, creating a scenario where finalize_pkvm() proceeds even when kvm_arm_init() has failed. The absence of this synchronization mechanism leads to cascading failures within the hypervisor layer, ultimately resulting in a kernel panic and system instability.
The technical root cause of this vulnerability lies in the improper error handling within the PKVM (Protected Kernel Virtual Machine) initialization sequence. When kvm_arm_init() fails during the kernel boot process, the system should halt further initialization steps to prevent inconsistent states. However, finalize_pkvm() continues execution without verifying the success of the preceding initialization step. This failure mode directly violates the principle of defensive programming and error propagation that is fundamental to secure system design. The error code -22 returned by kvm_arm_init() indicates an invalid argument condition, which should halt the initialization sequence entirely.
The operational impact of this vulnerability is severe, particularly in virtualized environments running on arm64 platforms. Upon encountering the initialization failure, the system generates multiple warning messages indicating failures in hypervisor memory protection setup and reports an error initializing hypervisor mode. The subsequent HYP panic occurs when the system attempts to finalize hypervisor protections without proper initialization, leading to a complete system crash. This vulnerability affects systems using the FVP Base RevC device tree and demonstrates a critical flaw in the kernel's module initialization framework, particularly in how it handles inter-module dependencies and error propagation.
The fix for this vulnerability involves implementing a proper check within finalize_pkvm() to verify that kvm_arm_init() completed successfully before proceeding with any further initialization steps. This solution addresses the core issue by introducing the missing synchronization mechanism between these two initialization functions. The remediation aligns with best practices in kernel security and follows the CWE-755 principle of "Improper Handling of Exceptional Conditions." This fix ensures that the hypervisor initialization sequence maintains proper state management and prevents the execution of subsequent functions when prerequisites have not been met. The mitigation strategy also corresponds to ATT&CK technique T1499.001, which involves preventing system instability through proper error handling and initialization sequence management, thereby protecting against potential denial-of-service conditions and system crashes that could be exploited in virtualized environments.