Cloudanix VulnDB

CVE-2023-53470

None

CVSS

—

EPSS

0.2%

Published

Oct 1, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in a Linux network driver can make the whole computer crash if a memory request fails during startup.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing NULL check after devlink_alloc() in the ionic driver causes devlink_priv() to be called on a NULL pointer, triggering a kernel panic on allocation failure.

Why it matters to the business

Unexpected kernel crashes during driver initialization lead to system downtime, loss of network connectivity, and potential data loss on affected Linux hosts.

How an attack unfolds

An attacker or administrator triggers ionic driver probe or load under conditions where devlink_alloc() returns NULL; the absent check allows the subsequent devlink_priv() call to dereference NULL and panic the kernel.

How to fix it

Update the Linux kernel to commit c177dd465f5c1e5f242cdb9258826c591c257e9a or later; for packaged distributions apply the equivalent fix that adds the NULL return check after devlink_alloc().

How to confirm the fix worked

Inspect the ionic driver source for the added NULL check immediately after the devlink_alloc() call and confirm the driver loads without panic under allocation-failure test conditions.

Typical attack path

  1. Cause devlink_alloc() to fail during ionic driver initialization
  2. Driver code invokes devlink_priv() on the NULL return value
  3. Kernel performs invalid memory access and panics

How to detect it

Examine kernel panic logs, dmesg output, and system crash dumps for references to ionic, devlink_alloc, and devlink_priv around the time of unexpected reboots.

What your security team should do

  • Apply the referenced kernel commit or distribution update as soon as possible
  • Reboot systems after patching to ensure the ionic driver uses the fixed code path
  • Review kernel crash logs for ionic-related panics as an indicator of exposure

The record

In the Linux kernel, the following vulnerability has been resolved: ionic: catch failure from devlink_alloc Add a check for NULL on the alloc return. If devlink_alloc() fails and we try to use devlink_priv() on the NULL return, the kernel gets very unhappy and panics. With this fix, the driver load will still fail, but at least it won't panic the kernel.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 5.4.0 5.15.112

Related vulnerabilities