CVE-2023-53795

A race condition was identified in the iommufd subsystem of the Linux kernel where the IOMMUFD_DESTROY command incorrectly increments an object’s reference count without holding the expected exclusive synchronization (destroy_rwsem). This violates the assumption that temporary reference count elevations are always protected by the relevant lock, potentially leading to use of freed objects or other inconsistent states under concurrent access.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and precise timing to trigger a race condition during concurrent object destruction within the kernel's IOMMU user API (iommufd). To exploit the flaw, an attacker must have privileges to interact with the iommufd interface and initiate racing lifecycle operations. While an uncontrolled race could lead to kernel instability or a denial of service, the high complexity of the timing window and requirement for local access limit the practical severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.