CVE-2023-54292
A critical data race exists in the Linux kernel’s RDMA/irdma driver that can corrupt memory or crash the system. The race occurs while handling CQP requests and has been fixed in recent kernel releases. Users should update their kernel to a version that includes this patch.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users that run the RDMA/irdma driver, such as those using InfiniBand or RDMA over Converged Ethernet (RoCE) hardware. This includes system administrators and developers on servers and high‑performance computing clusters.
Real-world impact
An attacker could exploit the race to corrupt memory, crash the system, or potentially execute arbitrary code, leading to loss of confidentiality, integrity, or availability.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited without authentication or user interaction, has a low complexity, and can fully compromise confidentiality, integrity, and availability.
What to do about it
- 01Verify your current kernel version.
- 02Check your distribution’s security advisories for a kernel update that includes the irdma data‑race fix.
- 03Install the updated kernel package.
- 04Reboot the system to use the new kernel.
NVD description indicates the issue has been resolved in the Linux kernel.
Timeline
- Dec 30, 2025 · Dec 30, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.