What’s Vulnerable › Vulnerabilities

CVE-2023-52790: swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-21 · updated 2026-08-04
• Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC Limit the free list length to the size of the IO TLB. Transient pool can be smaller than IO_TLB_SEGSIZE, but the free list is initialized with the assumption that the total number of slots is a multiple of IO_TLB_SEGSIZE. As a result, swiotlb_area_find_slots() may allocate slots past the end of a transient IO TLB buffer.

Affected products

• Linux kernel: from 6.6 before 6.6.3 — fixed in 6.6.3

How to fix

Upgrade to a fixed version: Linux kernel 6.6.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/53c87e846e335e3c18044c397cc35178163d7827
• https://git.kernel.org/stable/c/ce7612496a4ba6068bc68aa1fa9d947dadb4ad9b
• https://git.kernel.org/stable/c/53c87e846e335e3c18044c397cc35178163d7827
• https://git.kernel.org/stable/c/ce7612496a4ba6068bc68aa1fa9d947dadb4ad9b

Get alerted when CVE-2023-52790 or the next vulnerability affects your stack