CVE-2023-54081

Overview

A vulnerability in the Linux kernel's grant-table reclaim mechanism allows the deferred list of grant entries to grow excessively large. Normally, the list is small because PV network and block protocols expect the backend to unmap first, but Qubes OS's GUI protocol (constrained by the X Window System) results in the frontend unmapping window grants first, leading to a massive memory leak and eventual VM freeze [1].

Root

Cause When a grant entry remains in use by the remote domain, the kernel places it on a deferred list. While the code processes 10 entries per iteration by default, under the Qubes GUI workload the list can accumulate far more entries than can be freed per cycle, causing unbounded growth [1].

Impact

An attacker with access to the Qubes GUI protocol path (or any scenario causing deferred list buildup) can exhaust system memory, leading to a denial of service (VM freeze). The vulnerability does not require authentication beyond local access to trigger, as it stems from normal grant-table operations [1].

Mitigation

The fix, committed to the Linux kernel stable tree, introduces a module parameter (gnttab_max_free_entries) to make the number of entries freed per iteration tunable. The default remains 10, but administrators can increase it to handle workloads like Qubes OS's GUI protocol, preventing the memory leak and VM freeze [1].