CVE-2023-54156
Unknown Unknown - Not Provided

NULL Pointer Dereference in Linux sfc Driver Causes Kernel Crash

Publication date: 2025-12-24

Last updated on: 2025-12-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sfc: fix crash when reading stats while NIC is resetting efx_net_stats() (.ndo_get_stats64) can be called during an ethtool selftest, during which time nic_data->mc_stats is NULL as the NIC has been fini'd. In this case do not attempt to fetch the latest stats from the hardware, else we will crash on a NULL dereference: BUG: kernel NULL pointer dereference, address: 0000000000000038 RIP efx_nic_update_stats abridged calltrace: efx_ef10_update_stats_pf efx_net_stats dev_get_stats dev_seq_printf_stats Skipping the read is safe, we will simply give out stale stats. To ensure that the free in efx_ef10_fini_nic() does not race against efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the efx->stats_lock in fini_nic (it is already held across update_stats).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-12-24
Last Modified
2025-12-24
Generated
2026-07-06
AI Q&A
2025-12-24
EPSS Evaluated
2026-07-05
NVD
CVE-2023-54156
EUVD
EUVD-2023-60289

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs in the Linux kernel's sfc driver where a NULL pointer dereference can happen when reading network interface card (NIC) statistics during a NIC reset. Specifically, the function efx_net_stats() can be called during an ethtool selftest while the NIC is being finalized (fini'd), causing the mc_stats pointer to be NULL. Attempting to fetch stats from hardware in this state causes a kernel crash due to a NULL pointer dereference. The fix involves skipping the hardware stats read in this scenario to avoid the crash and using locking to prevent race conditions.

Impact Analysis

This vulnerability can cause the Linux kernel to crash (kernel panic) when reading NIC statistics during a NIC reset, leading to system instability or downtime. This can disrupt network operations and affect the availability of services running on the affected system.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the sfc driver has been fixed to avoid crashes when reading stats during NIC reset. Avoid running ethtool selftests on affected NICs until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-54156. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart