CVE-2023-54090
A critical vulnerability in the Linux kernel's ixgbe driver causes a panic when handling XDP (eXpress Data Path) traffic on systems with more than 64 CPUs. The issue arises from improper indexing of XDP TX rings, leading to an out-of-bounds array access. A fix exists in a kernel patch that adjusts ring indexing logic.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Systems using the ixgbe driver (common in network hardware) with more than 64 CPUs, particularly those running Linux kernels prior to the fix.
Real-world impact
Could cause system crashes (kernel panics) during XDP traffic processing, potentially leading to service disruptions.
Why this severity
CVSS 9.8 (Critical): High confidence in exploitation, full system compromise possible.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix from commit 4fe815850bdc (or later).
- 02Verify the kernel version post-upgrade includes the patch (e.g., check `/proc/version`).
- 03Reboot the system after applying the kernel update to ensure changes take effect.
NVD description and commit 4fe815850bdc in the Linux kernel source.
Timeline
- Dec 24, 2025 · Dec 24, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.