CVE-2023-54095

A slab-out-of-bounds read vulnerability was found in the Linux kernel's PowerPC IOMMU code. The fail_iommu_setup() function registers the same notifier_block structure to both PCI and VIO buses. Since notifier_block is a linked list node, this causes notifiers registered to one bus type to also apply to the other. The VGA arbiter code then incorrectly processes VIO devices as PCI devices, causing an out-of-bounds memory access.

This flaw affects only PowerPC systems with both PCI and VIO buses, typically IBM POWER servers running with IOMMU fail injection enabled. The out-of-bounds read occurs during device registration at boot time. Most PowerPC systems in production do not enable fail_iommu, limiting the practical impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.