CVE-2023-53989
published 2025-12-24CVE-2023-53989: In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and…
PriorityP420medium5.5
EPSS
0.18%
7.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
arm64: mm: fix VA-range sanity check
Both create_mapping_noalloc() and update_mapping_prot() sanity-check
their 'virt' parameter, but the check itself doesn't make much sense.
The condition used today appears to be a historical accident.
The sanity-check condition:
if ((virt >= PAGE_END) && (virt = VA_START) && (virt = PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}
Correct the condition to check against the start of the TTBR1 address
space, which is currently PAGE_OFFSET. This simplifies the logic, and
more clearly matches the "outside kernel range" message in the warning.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.191-1 (bullseye) | linux 5.10.191-1 (bullseye) |
| linux | linux | — | — |
| linux | linux | >= 14c127c957c1c6070647c171e72f06e0db275ebf < 9d8d3df71516ec3236d8d93ff029d251377ba4b1 | 9d8d3df71516ec3236d8d93ff029d251377ba4b1 |
| linux | linux | >= 14c127c957c1c6070647c171e72f06e0db275ebf < 32020fc2a8373d3de35ae6d029d5969a42651e7a | 32020fc2a8373d3de35ae6d029d5969a42651e7a |
| linux | linux | >= 14c127c957c1c6070647c171e72f06e0db275ebf < 621619f626cbe702ddbdc54117f3868b8ebd8129 | 621619f626cbe702ddbdc54117f3868b8ebd8129 |
| linux | linux | >= 14c127c957c1c6070647c171e72f06e0db275ebf < c7a9e967cc9615a1dabc5e0e6fdbe88a172d5a5b | c7a9e967cc9615a1dabc5e0e6fdbe88a172d5a5b |
| linux | linux | >= 14c127c957c1c6070647c171e72f06e0db275ebf < b03c7fcc5ed854d0e1b27e9abf12428bfa751a37 | b03c7fcc5ed854d0e1b27e9abf12428bfa751a37 |
| linux | linux | >= 14c127c957c1c6070647c171e72f06e0db275ebf < ab9b4008092c86dc12497af155a0901cc1156999 | ab9b4008092c86dc12497af155a0901cc1156999 |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 5.11.0 < 5.15.150 | 5.15.150 |
| linux | linux_kernel | >= 5.16.0 < 6.4.7 | 6.4.7 |
| linux | linux_kernel | >= 5.4.0 < 5.4.251 | 5.4.251 |
| linux | linux_kernel | >= 5.5.0 < 5.10.188 | 5.10.188 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-53989: In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and update_mapp
osv·2025-12-24
CVE-2023-53989 CVE-2023-53989: In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and update_mapp
In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and update_mapping_prot() sanity-check their 'virt' parameter, but the check itself doesn't make much sense. The condition used today appears to be a historical accident. The sanity-check condition: if ((virt >= PAGE_END) && (virt = VA_START) && (virt = PAGE_END) && (virt < VMALLOC_START)) { [ ... warning here ... ] return; } Correct the condition to check against the start of the TTBR1 address space, which is currently PAGE_OFFSET. This simplifies the logic, and more clearly matches the "outside kernel range" message in the warning.
OSV
arm64: mm: fix VA-range sanity check
osv·2025-12-24
CVE-2023-53989 arm64: mm: fix VA-range sanity check
arm64: mm: fix VA-range sanity check
In the Linux kernel, the following vulnerability has been resolved:
arm64: mm: fix VA-range sanity check
Both create_mapping_noalloc() and update_mapping_prot() sanity-check
their 'virt' parameter, but the check itself doesn't make much sense.
The condition used today appears to be a historical accident.
The sanity-check condition:
if ((virt >= PAGE_END) && (virt = VA_START) && (virt = PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}
Correct the condition to check against the start of the TTBR1 address
space, which is currently PAGE_OFFSET. This simplifies the logic, and
more clearly matches the "outside kernel range" message in the warning.
GHSA
GHSA-49xq-j8p7-h965: In the Linux kernel, the following vulnerability has been resolved:
arm64: mm: fix VA-range sanity check
Both create_mapping_noalloc() and update_ma
ghsa_unreviewed·2025-12-24
CVE-2023-53989 GHSA-49xq-j8p7-h965: In the Linux kernel, the following vulnerability has been resolved:
arm64: mm: fix VA-range sanity check
Both create_mapping_noalloc() and update_ma
In the Linux kernel, the following vulnerability has been resolved:
arm64: mm: fix VA-range sanity check
Both create_mapping_noalloc() and update_mapping_prot() sanity-check
their 'virt' parameter, but the check itself doesn't make much sense.
The condition used today appears to be a historical accident.
The sanity-check condition:
if ((virt >= PAGE_END) && (virt = VA_START) && (virt = PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}
Correct the condition to check against the start of the TTBR1 address
space, which is currently PAGE_OFFSET. This simplifies the logic, and
more clearly matches the "outside kernel range" message in the warning.
Red Hat
kernel: arm64: mm: fix VA-range sanity check
vendor_redhat·2025-12-24·CVSS 5.5
CVE-2023-53989 [MEDIUM] CWE-1285 kernel: arm64: mm: fix VA-range sanity check
kernel: arm64: mm: fix VA-range sanity check
In the Linux kernel, the following vulnerability has been resolved:
arm64: mm: fix VA-range sanity check
Both create_mapping_noalloc() and update_mapping_prot() sanity-check
their 'virt' parameter, but the check itself doesn't make much sense.
The condition used today appears to be a historical accident.
The sanity-check condition:
if ((virt >= PAGE_END) && (virt = VA_START) && (virt = PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}
Correct the condition to check against the start of the TTBR1 address
space, which is currently PAGE_OFFSET. This simplifies the logic, and
more clearly matches the "outside kernel range" message in the warning.
A logic flaw was found in the Linux kernel's arm64 memory management subsystem
Debian
CVE-2023-53989: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: mm: ...
vendor_debian·2023
CVE-2023-53989 CVE-2023-53989: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: mm: ...
In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and update_mapping_prot() sanity-check their 'virt' parameter, but the check itself doesn't make much sense. The condition used today appears to be a historical accident. The sanity-check condition: if ((virt >= PAGE_END) && (virt = VA_START) && (virt = PAGE_END) && (virt < VMALLOC_START)) { [ ... warning here ... ] return; } Correct the condition to check against the start of the TTBR1 address space, which is currently PAGE_OFFSET. This simplifies the logic, and more clearly matches the "outside kernel range" message in the warning.
Scope: local
bookworm: open
bullseye: resolved (fixed in 5.10.191-1)
forky: resolved (fixed in 6.4.11-1)
sid: resolved (fixed
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-53989 kernel: arm64: mm: fix VA-range sanity check
bugzilla·2025-12-24
CVE-2023-53989 [MEDIUM] CVE-2023-53989 kernel: arm64: mm: fix VA-range sanity check
CVE-2023-53989 kernel: arm64: mm: fix VA-range sanity check
In the Linux kernel, the following vulnerability has been resolved:
arm64: mm: fix VA-range sanity check
Both create_mapping_noalloc() and update_mapping_prot() sanity-check
their 'virt' parameter, but the check itself doesn't make much sense.
The condition used today appears to be a historical accident.
The sanity-check condition:
if ((virt >= PAGE_END) && (virt = VA_START) && (virt = PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}
Correct the condition to check against the start of the TTBR1 address
space, which is currently PAGE_OFFSET. This simplifies the logic, and
more clearly matches the "outside kernel range" message in the warning.
Discussion:
Upstream advisory:
https://lore.kernel.org/li
Wiz
CVE-2023-53989 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-53989 CVE-2023-53989 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-53989 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
arm64: mm: fix VA-range sanity check
Both create_mapping_noalloc() and update_mapping_prot() sanity-check
their 'virt' parameter, but the check itself doesn't make much sense.
The condition used today appears to be a historical accident.
The sanity-check condition:
if ((virt >= PAGE_END) && (virt = VA_START) && (virt = PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}
Correct the condition to check against the start of the TTBR1 address
space, which is currently PAGE_OFFSET. This simplifies the logic, and
more clearly matches the "outside kernel range" message in the warning.
Source : NVD
Published December 24, 2025
CNA
https://git.kernel.org/stable/c/32020fc2a8373d3de35ae6d029d5969a42651e7ahttps://git.kernel.org/stable/c/621619f626cbe702ddbdc54117f3868b8ebd8129https://git.kernel.org/stable/c/9d8d3df71516ec3236d8d93ff029d251377ba4b1https://git.kernel.org/stable/c/ab9b4008092c86dc12497af155a0901cc1156999https://git.kernel.org/stable/c/b03c7fcc5ed854d0e1b27e9abf12428bfa751a37https://git.kernel.org/stable/c/c7a9e967cc9615a1dabc5e0e6fdbe88a172d5a5b
2025-12-24
Published