CVE-2023-54106

What it actually does

Memory pointed to by priv->rx_res is not released on the error path of mlx5e_init_rep_rx, leaving the allocation alive after the function returns failure.

Why it matters to the business

Over time, repeated triggering of the error path can deplete kernel memory on systems using the affected mlx5 driver, leading to performance degradation or crashes that disrupt network-dependent services.

How an attack unfolds

An attacker with the ability to induce repeated initialization failures in the mlx5 representor receive path (for example through specific device configuration or error injection) causes the kernel to leak small amounts of memory on each failure; sustained triggering gradually exhausts available memory until the system becomes unstable.

How to fix it

Update the Linux kernel to a version containing commit 0582a3caaa3e2f7b80bcb113ad3c910eac15a63e or later; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 0582a3caaa3e2f7b80bcb113ad3c910eac15a63e by checking the git log or kernel version string; exercise mlx5e_init_rep_rx error paths in a test environment and verify with memory-leak detection tools that rx_res is released.

Typical attack path

1. Obtain local or privileged access sufficient to trigger mlx5e_init_rep_rx error paths
2. Repeatedly force the error condition during representor RX initialization
3. Monitor system memory usage as allocations accumulate without being freed
4. Continue until memory pressure causes denial of service or forces a reboot

How to detect it

Review kernel logs and slab allocator statistics for unexpected growth in allocations associated with mlx5 representor RX resources after initialization failures; correlate with dmesg entries showing mlx5e_init_rep_rx errors.

What your security team should do

• Prioritize kernel updates on systems using mlx5 representors in production
• Apply the fix during the next scheduled maintenance window if immediate reboot is disruptive
• Monitor kernel memory statistics on mlx5-equipped hosts until patches are deployed