CVE-2023-52658

What it actually does

Local process can trigger a kernel crash (NULL dereference or similar) by entering switchdev mode on mlx5 devices under network namespace inconsistency conditions after the flawed blocking commit was active.

Why it matters to the business

Unprivileged local users can cause denial of service on affected Linux systems, leading to unplanned reboots, service outages, and potential data loss for workloads running on those kernels; widespread in servers, containers, and embedded devices using the mlx5 driver.

How an attack unfolds

An attacker with local access crafts or triggers network namespace operations that expose the inconsistency check flaw in mlx5 switchdev mode entry, causing the kernel to panic and reboot the system. No remote vector or privilege escalation is involved.

How to fix it

Upgrade to a fixed kernel version such as 6.1.162 or later stable releases containing commit 136ccb2041a5d1a475f845d3bc138550be6f5daa. For Ubuntu packages, apply the listed backports (e.g., wireshark 2.6.3-1~ubuntu18.04.1 and equivalents). Reboot after kernel update and verify mlx5 switchdev behavior.

How to confirm the fix worked

Confirm kernel version is at or above the listed fixed releases, test switchdev mode entry under namespace inconsistency scenarios without panic, and review dmesg for absence of the original crash signatures.

Typical attack path

1. Obtain local shell or code execution on the target Linux system
2. Manipulate network namespaces or mlx5 device configuration to trigger switchdev mode entry
3. Trigger the inconsistent state that the reverted commit failed to safely block
4. Observe kernel panic and system reboot

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for mlx5 switchdev mode entry messages followed immediately by panic or oops traces around the time of the original commit; correlate with process activity creating network namespaces.

What your security team should do

• Prioritize kernel upgrades on all systems exposing mlx5 hardware within the next maintenance window
• Restrict local user access to network configuration commands until patched
• Monitor for post-patch stability in switchdev-enabled environments