CVE-2023-54089 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
virtio_pmem: add the missing REQ_OP_WRITE for flush bio
When doing mkfs.xfs on a pmem device, the following warning was
------------[ cut here ]------------
WARNING: CPU: 2 PID: 384 at block/blk-core.c:751 submit_bio_noacct Modules linked in: CPU: 2 PID: 384 Comm: mkfs.xfs Not tainted 6.4.0-rc7+ #154 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:submit_bio_noacct+0x340/0x520 ...... Call Trace: <TASK> ? submit_bio_noacct+0xd5/0x520 submit_bio+0x37/0x60 async_pmem_flush+0x79/0xa0 nvdimm_flush+0x17/0x40 pmem_submit_bio+0x370/0x390 __submit_bio+0xbc/0x190 submit_bio_noacct_nocheck+0x14d/0x370 submit_bio_noacct+0x1ef/0x520 submit_bio+0x55/0x60 submit_bio_wait+0x5a/0xc0 blkdev_issue_flush+0x44/0x60
The root cause is that submit_bio_noacct() needs bio_op() is either WRITE or ZONE_APPEND for flush bio and async_pmem_flush() doesn't assign REQ_OP_WRITE when allocating flush bio, so submit_bio_noacct just fail the flush bio.
Simply fix it by adding the missing REQ_OP_WRITE for flush bio. And we could fix the flush order issue and do flush optimization later.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/02/2026
The vulnerability CVE-2023-54089 affects the Linux kernel's virtio pmem driver and represents a critical issue in how flush operations are handled for persistent memory devices. This flaw manifests when performing filesystem creation operations such as mkfs.xfs on pmem devices, where the kernel generates warning messages indicating a failure in the block I/O subsystem. The issue stems from the improper handling of bio operations during flush sequences, specifically when the async_pmem_flush function fails to properly assign the REQ_OP_WRITE operation flag when allocating flush bio structures. This misconfiguration causes the submit_bio_noacct function to reject flush operations, leading to potential data integrity issues and system instability during persistent memory operations. The vulnerability is classified under CWE-457 as a use of uninitialized variable, specifically in the context of block I/O operation flags.
The technical implementation flaw occurs within the virtio pmem subsystem where the flush bio allocation process does not properly set the required operation type flags. The kernel's block layer expects flush bio operations to have either WRITE or ZONE_APPEND operation types through the bio_op() function, but the async_pmem_flush function omits setting REQ_OP_WRITE during flush bio creation. This results in the submit_bio_noacct function failing the flush bio operations due to the missing operation flag, which violates the expected I/O operation semantics defined in the Linux kernel block layer architecture. The call stack shows the failure propagates through multiple kernel subsystems including block/blk-core.c, nvdimm_flush, and pmem_submit_bio, demonstrating the cascading impact of this single missing flag assignment. This issue directly relates to ATT&CK technique T1547.001 for kernel rootkits and T1059.004 for kernel module manipulation.
The operational impact of this vulnerability extends beyond simple warning messages to potentially compromise data integrity during persistent memory operations. When mkfs.xfs or similar filesystem creation tools attempt to flush data to pmem devices, the failed flush operations can result in incomplete filesystem creation, corrupted data structures, or inconsistent state across the persistent memory device. This particularly affects systems utilizing Intel Optane DC Persistent Memory or similar technologies where the pmem subsystem is critical for data persistence guarantees. The vulnerability also impacts performance optimization opportunities since flush order issues and flush optimization cannot be properly implemented while this fundamental operation flag is missing. Systems running with persistent memory workloads are particularly vulnerable, especially those performing frequent filesystem operations or data-intensive applications that rely on consistent flush behavior. The failure mode represents a denial of service condition where critical storage operations may fail silently or with explicit error messages, potentially leading to application crashes or data loss scenarios.
The mitigation for CVE-2023-54089 involves a straightforward fix to the virtio pmem driver where the missing REQ_OP_WRITE flag is properly assigned during flush bio allocation. This patch ensures that flush operations are properly recognized by the kernel's block layer and can complete successfully without triggering the warning conditions. The fix aligns with established kernel development practices for maintaining I/O operation semantics and proper bio flag handling. System administrators should update to kernel versions containing this fix, particularly those running persistent memory workloads or systems utilizing virtio pmem drivers. Organizations should prioritize patching systems where mkfs.xfs or similar tools are regularly executed on pmem devices, as well as systems handling critical persistent memory operations. The fix does not require architectural changes or system reconfiguration, making it suitable for immediate deployment in production environments. Regular monitoring of kernel security updates and vulnerability assessments should include verification that this specific patch is applied, especially in environments where persistent memory technologies are utilized for database operations, caching systems, or other performance-critical applications relying on persistent storage semantics.