CVE-2023-54129
Unknown Unknown - Not Provided
Invalid lmac_type_id Validation Causes Kernel Panic in Linux octeontx2-af

Publication date: 2025-12-24

Last updated on: 2025-12-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac_type based on lmac_type_id received from firmware. In a few scenarios, firmware returns an invalid lmac_type_id, which is resulting in below kernel panic. This patch adds the missing validation of the lmac_type_id field. Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 35.321595] Modules linked in: [ 35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted 5.4.210-g2e3169d8e1bc-dirty #17 [ 35.337014] Hardware name: Marvell CN103XX board (DT) [ 35.344297] Workqueue: events work_for_cpu_fn [ 35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO) [ 35.360267] pc : strncpy+0x10/0x30 [ 35.366595] lr : cgx_link_change_handler+0x90/0x180
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-24
Last Modified
2025-12-24
Generated
2026-06-16
AI Q&A
2025-12-24
EPSS Evaluated
2026-06-15
NVD
CVE-2023-54129
EUVD
EUVD-2023-60316
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel 5.4.210
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs in the Linux kernel's octeontx2-af driver where the kernel does not properly validate the lmac_type_id value received from the firmware upon a physical link change. In some cases, the firmware sends an invalid lmac_type_id, which causes the kernel to panic (crash). The patch adds validation to ensure the lmac_type_id is valid before the kernel uses it, preventing the panic.

Impact Analysis

If exploited or triggered, this vulnerability can cause the Linux kernel to panic and crash, leading to system instability or downtime. This can disrupt services running on affected systems, potentially causing loss of availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-54129. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart