CVE-2023-53614

In the Linux kernel, the following vulnerability has been resolved:

mm/ksm: fix race with VMA iteration and mm_struct teardown

exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held in write mode. Ensure that the maple tree is still valid by checking ksm_test_exit() after taking the mmap_lock in read mode, but before the for_each_vma() iterator dereferences a destroyed maple tree.

Since the maple tree is destroyed, the flags telling lockdep to check an external lock has been cleared. Skip the for_each_vma() iterator to avoid dereferencing a maple tree without the external lock flag, which would create a lockdep warning.

A race in KSM’s VMA iteration vs. exit_mmap() could dereference a torn-down maple tree, leading to kernel crashes. This issue can only be triggered when Kernel Samepage Merging (KSM) is actively running. If KSM is disabled (/sys/kernel/mm/ksm/run == 0), the vulnerable code path in unmerge_and_remove_all_rmap_items() is not executed, making practical exploitation highly unlikely. For the Red Hat Enterprise Linux this bug introduced and fixed the same time (in 9.5), so no affected versions, and KSM disabled by default.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate the issue have to disable KSM. To verify whether KSM is enabled, run:

sudo cat /sys/kernel/mm/ksm/run

If the command returns 0, KSM is disabled; if it returns 1, it is active.