CVE-2023-53614: mm/ksm: fix race with VMA iteration and mm_struct teardown

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-04 · updated 2026-06-17
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix race with VMA iteration and mm_struct teardown exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held in write mode. Ensure that the maple tree is still valid by checking ksm_test_exit() after taking the mmap_lock in read mode, but before the for_each_vma() iterator dereferences a destroyed maple tree. Since the maple tree is destroyed, the flags telling lockdep to check an external lock has been cleared. Skip the for_each_vma() iterator to avoid dereferencing a maple tree without the external lock flag, which would create a lockdep warning.

Affected products

Linux kernel: from 6.1 before 6.1.22; from 6.2 before 6.2.9; 6.3-rc1, 6.3-rc2, 6.3-rc3 — fixed in 6.1.22, 6.2.9

How to fix

Upgrade to a fixed version: Linux kernel 6.1.22, 6.2.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53614 or the next vulnerability affects your stack