CVE-2023-54095

What it actually does

Shared notifier_block struct registered on both PCI and VIO buses causes linked-list node reuse, leading to type confusion where VIO device additions invoke PCI handlers such as vga_arbiter_add_pci_device, resulting in slab-out-of-bounds reads.

Why it matters to the business

Kernel instability or crashes during PowerPC device initialization on systems using both PCI and VIO buses, increasing operational downtime risk until patched; low exploitability and no known campaigns limit immediate threat but patching remains necessary for stability.

How an attack unfolds

An attacker triggers VIO device registration during boot or hotplug on affected PowerPC hardware, causing the notifier chain to invoke PCI-specific code paths on non-PCI objects and produce invalid memory accesses.

How to fix it

Apply kernel commit dc0d107e624ca96aef6dd8722eb33ba3a6d157b0 or later stable releases containing the fix that creates separate notifier_block instances per bus type; rebuild and deploy updated kernel images.

How to confirm the fix worked

Verify presence of separate notifier structs in powerpc/iommu code after update, boot test systems with VIO and PCI devices, and confirm absence of KASAN slab-out-of-bounds reports during vio_register_device_node.

Typical attack path

1. Initiate VIO bus scan or device addition
2. Notifier chain invokes shared fail_iommu_bus_notifier
3. pci_notify called on VIO device
4. to_pci_dev conversion produces invalid pointer
5. Out-of-bounds access in vga_arbiter_add_pci_device

How to detect it

Search kernel logs and KASAN reports for vga_arbiter_add_pci_device slab-out-of-bounds accesses triggered from vio_register_device_node or notifier_call_chain during early boot on PowerPC.

What your security team should do

• Prioritize kernel updates on PowerPC systems within standard change windows
• Test device initialization paths in staging environments before production rollout
• Monitor kernel logs for notifier-related crashes post-deployment