---
id: CVE-2023-53171
title: 'vfio/type1: prevent underflow of locked_vm via exec()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vfio/type1: prevent underflow of locked_vm via exec()

  When a vfio container is preserved across exec, the task does not change,
  but it gets a new mm with locked_vm=0, …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 73fa0d10d077d9521ee2dace2307ae2c9a965336 <
    5a271242716846cc016736fb76be2b40ee49b0c3
  - >-
    Linux >= 73fa0d10d077d9521ee2dace2307ae2c9a965336 <
    eafb81c50da899dd80b340c841277acc4a1945b7
  - >-
    Linux >= 73fa0d10d077d9521ee2dace2307ae2c9a965336 <
    a6b2aabe664098d5cf877ae0fd96459464a30e17
  - >-
    Linux >= 73fa0d10d077d9521ee2dace2307ae2c9a965336 <
    b0790dff0760b7734cf0961f497ad64628ca550b
  - >-
    Linux >= 73fa0d10d077d9521ee2dace2307ae2c9a965336 <
    046eca5018f8a5dd1dc2cedf87fb5843b9ea3026
  - Linux 3.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:19:31.308390Z'
published: '2025-09-15'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:21:06.077Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53171'
references:
  - url: 'https://git.kernel.org/stable/c/5a271242716846cc016736fb76be2b40ee49b0c3'
  - url: 'https://git.kernel.org/stable/c/eafb81c50da899dd80b340c841277acc4a1945b7'
  - url: 'https://git.kernel.org/stable/c/a6b2aabe664098d5cf877ae0fd96459464a30e17'
  - url: 'https://git.kernel.org/stable/c/b0790dff0760b7734cf0961f497ad64628ca550b'
  - url: 'https://git.kernel.org/stable/c/046eca5018f8a5dd1dc2cedf87fb5843b9ea3026'
tags:
  - cve.org
epss: 0.00159
epssPercentile: 0.05079
ingestedAt: '2026-11-05T22:38:31.783Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vfio/type1: prevent underflow of locked_vm via exec()

When a vfio container is preserved across exec, the task does not change,
but it gets a new mm with locked_vm=0, and loses the count from existing
dma mappings.  If the user later unmaps a dma mapping, locked_vm underflows
to a large unsigned value, and a subsequent dma map request fails with
ENOMEM in __account_locked_vm.

To avoid underflow, grab and save the mm at the time a dma is mapped.
Use that mm when adjusting locked_vm, rather than re-acquiring the saved
task's mm, which may have changed.  If the saved mm is dead, do nothing.

locked_vm is incremented for existing mappings in a subsequent patch.

## Affected

- `Linux >= 73fa0d10d077d9521ee2dace2307ae2c9a965336 < 5a271242716846cc016736fb76be2b40ee49b0c3`
- `Linux >= 73fa0d10d077d9521ee2dace2307ae2c9a965336 < eafb81c50da899dd80b340c841277acc4a1945b7`
- `Linux >= 73fa0d10d077d9521ee2dace2307ae2c9a965336 < a6b2aabe664098d5cf877ae0fd96459464a30e17`
- `Linux >= 73fa0d10d077d9521ee2dace2307ae2c9a965336 < b0790dff0760b7734cf0961f497ad64628ca550b`
- `Linux >= 73fa0d10d077d9521ee2dace2307ae2c9a965336 < 046eca5018f8a5dd1dc2cedf87fb5843b9ea3026`
- `Linux 3.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.