CVE-2023-53501

What it actually does

Race condition in AMD IOMMU v2 PASID unbind allows pasid_state refcount to hit zero when outstanding page fault notifications exist, causing refcount_dec to trigger REFCOUNT_WARN instead of proper handling via refcount_dec_and_test.

Why it matters to the business

May lead to kernel warnings, potential memory leaks or instability on AMD IOMMU-enabled Linux systems in virtualized or containerized environments; high ecosystem prevalence across Debian releases but low exploitation likelihood and no ransomware or KEV usage.

How an attack unfolds

Attacker with local access to bind/unbind PASIDs and induce page faults on AMD IOMMU v2 systems races the unbind path against PPR notifications to trigger the refcount decrement-to-zero condition; VMSCAPE and related container privilege escalation campaigns have targeted similar Linux kernel IOMMU/PASID weaknesses.

How to fix it

Upgrade to fixed kernel versions: Debian 11/12/13/14 to 5.10.46-1 or later; mainline to commit a50d60b8f2aff46dd7c7edb4a5835cdc4d432c22 or equivalent stable backports.

How to confirm the fix worked

Verify running kernel contains the referenced commit or package version 5.10.46-1+; inspect dmesg or kernel logs for absence of the pasid_state refcount decrement warning on unbind operations.

Typical attack path

1. Obtain local access on AMD IOMMU-enabled Linux host
2. Bind a PASID and arrange for concurrent page fault notifications
3. Trigger PASID unbind while notifications are in flight
4. Observe or exploit resulting refcount warning and potential side effects

How to detect it

Search kernel logs and dmesg for REFCOUNT_WARN messages mentioning pasid_state or decrement hit 0 during PASID unbind operations; correlate with AMD IOMMU activity and container or VM lifecycle events.

• REFCOUNT_WARN("decrement hit 0; leaking memory")
• pasid_state refcount dec hit 0 warning
• iommu/amd/iommu_v2

What your security team should do

• Prioritize kernel upgrades on all AMD IOMMU systems within 30 days given published fixes
• Monitor EPSS trend and threat actor activity around container escape paths
• Restrict unprivileged PASID binding where possible via IOMMU policy