CVE-2023-54223
A critical bug in the Linux kernel’s mlx5e driver could cause a system crash when using XDP REDIRECT with legacy receive queues. The flaw occurs because a buffer is released twice, leading to a kernel panic. The issue has been fixed in newer kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux systems that use the mlx5e network driver with XDP REDIRECT in legacy receive queue mode, typically servers or workstations running recent kernels.
Real-world impact
An attacker could trigger a kernel crash, causing a denial of service and potentially disrupting critical services on the affected machine.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact: it can completely compromise confidentiality, integrity, and availability (C, I, A) with no user interaction or special privileges needed. The attack is straightforward and can be executed remotely, making it extremely dangerous.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix for the mlx5e driver’s XDP REDIRECT buffer handling.
NVD-referenced vendor advisory
Timeline
- Dec 30, 2025 · Dec 30, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.