CVE-2023-54302
Data Race Vulnerability in Linux irdma RDMA Completion Stats
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| intel | irdma | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a data race condition in the Linux kernel's RDMA irdma driver. Specifically, the completion queue pair (CQP) completion statistics are accessed concurrently without proper synchronization: they are read locklessly in some functions while being updated in another completion thread on a different CPU. This can cause inconsistent or corrupted data due to race conditions. The fix involves making the completion statistics an atomic variable to ensure coherent updates and avoid potential bugs caused by compiler optimizations.
How can this vulnerability impact me? :
This vulnerability can lead to data corruption or inconsistent statistics in the RDMA irdma driver's completion queue processing. Such data races can cause unpredictable behavior, including potential kernel crashes or incorrect operation of RDMA functions relying on these statistics, which may affect system stability and reliability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for KCSAN (Kernel Concurrency Sanitizer) data-race warnings related to the irdma driver, specifically messages indicating data races in functions like irdma_handle_cqp_op or irdma_sc_ccq_get_cqe_info. You can use commands such as 'dmesg | grep KCSAN' or 'journalctl -k | grep irdma' to look for these indicators.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the irdma driver has been patched to fix the data race by making completion statistics atomic. Until an update is applied, consider disabling the irdma driver if it is not essential, to avoid triggering the race condition.