CVE-2023-54008 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
virtio_vdpa: build affinity masks conditionally
We try to build affinity mask via create_affinity_masks() unconditionally which may lead several issues:
- the affinity mask is not used for parent without affinity support (only VDUSE support the affinity now) - the logic of create_affinity_masks() might not work for devices other than block. For example it's not rare in the networking device where the number of queues could exceed the number of CPUs. Such case breaks the current affinity logic which is based on group_cpus_evenly() who assumes the number of CPUs are not less than the number of groups. This can trigger a warning[1]:
if (ret >= 0) WARN_ON(nr_present + nr_others < numgrps);
Fixing this by only build the affinity masks only when
- Driver passes affinity descriptor, driver like virtio-blk can make sure to limit the number of queues when it exceeds the number of CPUs - Parent support affinity setting config ops
This help to avoid the warning. More optimizations could be done on top.
[1]
[ 682.146655] WARNING: CPU: 6 PID: 1550 at lib/group_cpus.c:400 group_cpus_evenly+0x1aa/0x1c0
[ 682.146668] CPU: 6 PID: 1550 Comm: vdpa Not tainted 6.5.0-rc5jason+ #79
[ 682.146671] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
[ 682.146673] RIP: 0010:group_cpus_evenly+0x1aa/0x1c0
[ 682.146676] Code: 4c 89 e0 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc e8 1b c4 74 ff 48 89 ef e8 13 ac 98 ff 4c 89 e7 45 31 e4 e8 08 ac 98 ff eb c2 <0f> 0b eb b6 e8 fd 05 c3 00 45 31 e4 eb e5 cc cc cc cc cc cc cc cc
[ 682.146679] RSP: 0018:ffffc9000215f498 EFLAGS: 00010293
[ 682.146682] RAX: 000000000001f1e0 RBX: 0000000000000041 RCX: 0000000000000000
[ 682.146684] RDX: ffff888109922058 RSI: 0000000000000041 RDI: 0000000000000030
[ 682.146686] RBP: ffff888109922058 R08: ffffc9000215f498 R09: ffffc9000215f4a0
[ 682.146687] R10: 00000000000198d0 R11: 0000000000000030 R12: ffff888107e02800
[ 682.146689] R13: 0000000000000030 R14: 0000000000000030 R15: 0000000000000041
[ 682.146692] FS: 00007fef52315740(0000) GS:ffff888237380000(0000) knlGS:0000000000000000
[ 682.146695] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 682.146696] CR2: 00007fef52509000 CR3: 0000000110dbc004 CR4: 0000000000370ee0
[ 682.146698] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 682.146700] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 682.146701] Call Trace:
[ 682.146703] <TASK>
[ 682.146705] ? __warn+0x7b/0x130
[ 682.146709] ? group_cpus_evenly+0x1aa/0x1c0
[ 682.146712] ? report_bug+0x1c8/0x1e0
[ 682.146717] ? handle_bug+0x3c/0x70
[ 682.146721] ? exc_invalid_op+0x14/0x70
[ 682.146723] ? asm_exc_invalid_op+0x16/0x20
[ 682.146727] ? group_cpus_evenly+0x1aa/0x1c0
[ 682.146729] ? group_cpus_evenly+0x15c/0x1c0
[ 682.146731] create_affinity_masks+0xaf/0x1a0
[ 682.146735] virtio_vdpa_find_vqs+0x83/0x1d0
[ 682.146738] ? __pfx_default_calc_sets+0x10/0x10
[ 682.146742] virtnet_find_vqs+0x1f0/0x370
[ 682.146747] virtnet_probe+0x501/0xcd0
[ 682.146749] ? vp_modern_get_status+0x12/0x20
[ 682.146751] ? get_cap_addr.isra.0+0x10/0xc0
[ 682.146754] virtio_dev_probe+0x1af/0x260
[ 682.146759] really_probe+0x1a5/0x410
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/30/2026
The vulnerability identified as CVE-2023-54008 resides within the Linux kernel's virtio_vdpa subsystem, specifically concerning the unconditional invocation of the create_affinity_masks() function. This flaw manifests when the kernel attempts to build CPU affinity masks for virtual devices regardless of whether such functionality is supported or required by the parent device driver. The issue is particularly relevant in virtualized environments where virtio_vdpa is used to provide virtualized device access through the VDPA framework. When the affinity mask creation logic is executed without proper conditional checks, it can lead to operational disruptions and system warnings. The root cause lies in the assumption that all virtual devices require CPU affinity configuration, which is not true for all device types within the virtio ecosystem.
The technical flaw stems from the kernel's handling of CPU affinity masks in virtualized environments, where the create_affinity_masks() function is called irrespective of device capabilities or driver configurations. This problematic behavior becomes evident when dealing with network devices that may have more queues than available CPUs, a common scenario in high-performance virtualized networking. The underlying group_cpus_evenly() function, which forms part of the kernel's CPU group management utilities, makes assumptions about the relationship between CPU count and group count that break down when queues exceed CPU resources. This mismatch triggers kernel warnings as demonstrated in the stack trace, where the group_cpus_evenly() function encounters a condition that violates its internal validation logic. The warning occurs at line 400 in lib/group_cpus.c, indicating a direct failure in the CPU grouping algorithm when the number of present CPUs plus other CPUs is less than the required number of groups.
The operational impact of this vulnerability extends beyond simple warning messages to potentially affect system stability and performance in virtualized environments. The unconditional creation of affinity masks can cause unnecessary resource consumption and may lead to improper CPU distribution across virtual queues, particularly in network virtualization scenarios where queue counts can scale beyond physical CPU availability. This vulnerability affects the reliability of virtualized device drivers, especially those using the VDPA framework, and can result in suboptimal performance characteristics when virtual devices are configured with excessive queues. The issue particularly impacts drivers that do not properly limit queue counts relative to CPU availability, such as virtio-net drivers, which may attempt to create more queues than the system has CPUs to handle efficiently.
The fix for CVE-2023-54008 implements conditional logic that restricts affinity mask creation to only those scenarios where it is both necessary and supported. The solution ensures that affinity masks are only built when the driver explicitly passes an affinity descriptor and when the parent device supports affinity setting configuration operations. This approach aligns with established security practices by implementing proper input validation and conditional execution based on device capabilities. The mitigation strategy directly addresses the core issue by preventing the problematic call to create_affinity_masks() when the underlying assumptions of the CPU grouping algorithm are not met. This conditional approach prevents the kernel from attempting to create affinity masks for devices that do not support or require such configuration, particularly excluding devices without affinity support while maintaining functionality for those that do. The solution follows industry standards for kernel security by ensuring proper resource management and preventing erroneous system states through careful conditional logic implementation.
This vulnerability relates to CWE-691, which covers insufficient control of a resource through a privileged interface, and aligns with ATT&CK techniques involving privilege escalation through kernel vulnerabilities. The fix demonstrates proper kernel security practices by implementing conditional resource allocation and preventing unnecessary system operations that could lead to instability or performance degradation. The mitigation approach ensures that virtualized device drivers operate within their intended constraints while maintaining system stability and performance characteristics across different virtualization scenarios. The solution represents a targeted fix that addresses the specific conditions under which the warning occurs, rather than attempting broad system-wide changes that could introduce additional vulnerabilities.