CVE-2023-54074
Use-After-Free in Linux mlx5e Driver Causing Kernel Warning
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mellanox | mlx5_core | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's mlx5_core driver involves the incorrect use of the 'encap' attribute during invalidation. Specifically, while most users of the encap attribute were updated to use the correct attribute via the mlx5e_tc_get_encap_attr() helper, the mlx5e_invalidate_encap() function was not modified accordingly. This caused it to fail to destroy the correct modify header action, leading to kernel warnings and potential instability.
How can this vulnerability impact me? :
The vulnerability can lead to kernel warnings and potentially unstable behavior in the network driver (mlx5_core) related to encapsulation attribute handling. This could affect network performance or reliability on systems using the affected driver, possibly causing crashes or degraded network functionality.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system kernel logs for specific warning messages related to mlx5_core. Look for warnings similar to: 'WARNING: CPU: ... mlx5e_tc_attach_mod_hdr ... mlx5_core'. You can use the command 'dmesg | grep mlx5_core' or 'journalctl -k | grep mlx5_core' to find such warnings in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the mlx5e_invalidate_encap() function has been fixed to use the correct encap attribute, as described in the patch. Until then, monitoring for the warning messages and avoiding workloads that trigger this issue may help reduce impact.