Cloudanix VulnDB

CVE-2023-54237

None

CVSS

—

EPSS

0.6%

Published

Dec 30, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can make computers crash suddenly when handling certain network connections.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in the Linux kernel SMC module allows unprotected concurrent calls to smc_llc_srv_add_link(), breaking llc_conf_mutex protection and causing invalid memory access leading to kernel panic in ib_alloc_mr during link group operations.

Why it matters to the business

Affected Linux systems may experience sudden crashes and reboots when SMC connections attempt to establish multiple links, reducing service availability especially in clustered or high-performance networking environments.

How an attack unfolds

An attacker with local access initiates SMC connections that trigger creation of a second link while smc_llc_srv_add_link() runs without mutex protection, resulting in a page fault panic during memory region allocation in the RDMA/IB path.

How to fix it

Upgrade the Linux kernel to a version containing commit f2f46de98c11d41ac8d22765f47ba54ce5480a5b which adds proper mutex protection around smc_llc_srv_add_link().

How to confirm the fix worked

Confirm the running kernel includes the referenced fix commit; reproduce concurrent second-link creation under load to verify absence of panic in smc and ib paths.

Typical attack path

  1. Obtain local execution on a vulnerable Linux system
  2. Trigger concurrent SMC link setup operations
  3. Cause unprotected addition to the link group
  4. Trigger kernel panic via invalid pointer dereference

How to detect it

Review kernel logs and crash dumps for page_fault_oops originating from ib_alloc_mr or smc_ib_get_memory_region called via smcr_buf_map_link during kworker activity.

What your security team should do

  • Apply the kernel update containing the fix commit as soon as possible
  • Monitor kernel logs for smc-related page faults and oops
  • Disable SMC if not required until systems are patched

The record

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() There is a certain chance to trigger the following panic: PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:48" #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7 #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60 #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7 #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715 #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654 #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62 [exception RIP: ib_alloc_mr+19] RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004 RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000010 R14: ffff88c1ab040a50 R15: ffff88c1ea281d00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc] #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc] #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc] The reason here is that when the server tries to create a second link, smc_llc_srv_add_link() has no protection and may add a new link to link group. This breaks the security environment protected by llc_conf_mutex.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 5.8.0 6.1.16

Related vulnerabilities