Linux Kernel up to 6.4.4 tpm /dev/vtpmx tpm_vtpm_proxy initialization

Summaryinfo

A vulnerability has been found in Linux Kernel up to 6.4.4 and classified as critical. This issue affects the function tpm_vtpm_proxy of the file /dev/vtpmx of the component tpm. Performing a manipulation results in initialization. This vulnerability is cataloged as CVE-2023-54309. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Linux Kernel up to 6.4.4. This affects the function tpm_vtpm_proxy of the file /dev/vtpmx of the component tpm. The manipulation with an unknown input leads to a initialization vulnerability. CWE is classifying the issue as CWE-665. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation /dev/vtpmx is made visible before 'workqueue' is initialized, which can lead to a memory corruption in the worst case scenario. Address this by initializing 'workqueue' as the very first step of the driver initialization.

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2023-54309 since 12/30/2025. The exploitability is told to be difficult. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/01/2026).

Upgrading to version 4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.40 or 6.4.5 eliminates this vulnerability. Applying the patch 509d21f1c4bb9d35d397fca3226165b156a7639f/04e8697d26613ccea760cf57eb20a5a27f788c0f/86b9820395f226b8f33cbae9599deebf8af1ce72/9ff7fcb3a2ed0e9b895bb5b4c13872d584a8815b/e08295290c53a3cf174c236721747a01b9550ae2/99b998fb9d7d2d2d9dbb3e19db2d0ade02f5a604/092db954e2c3c5ba6c0ce990c7da72cf8f3b9c51/f4032d615f90970d6c3ac1d9c0bce3351eb4445c is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-2941). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.14.321
• 4.19.290
• 5.4.250
• 5.10.187
• 5.15.120
• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 6.1.8
• 6.1.9
• 6.1.10
• 6.1.11
• 6.1.12
• 6.1.13
• 6.1.14
• 6.1.15
• 6.1.16
• 6.1.17
• 6.1.18
• 6.1.19
• 6.1.20
• 6.1.21
• 6.1.22
• 6.1.23
• 6.1.24
• 6.1.25
• 6.1.26
• 6.1.27
• 6.1.28
• 6.1.29
• 6.1.30
• 6.1.31
• 6.1.32
• 6.1.33
• 6.1.34
• 6.1.35
• 6.1.36
• 6.1.37
• 6.1.38
• 6.1.39
• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion