CVE-2023-54000: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54000 is a deadlock vulnerability in the Linux kernel's Huawei Network Services (HNS3) network driver (net/hns3). It occurs when external load balancing (externel_lb) and system reset operations are executed concurrently, causing napi_disable() to be called twice and resulting in a mutex lock deadlock on rtnl_lock(). The vulnerability was published on December 24, 2025, and affects the Linux kernel on systems using the HNS3 network driver. The EPSS score is 0.018% (very low), and no CVSS score has been formally assigned at this time (Red Hat Bugzilla).

The root cause is a race condition and improper state management (CWE-667: Improper Locking) in the HNS3 driver's external load balancing (externel_lb) code path. During the externel_lb process, the driver calls napi_disable() first; if a reset then occurs, the restore process of externel_lb fails and does not call napi_enable(). On a subsequent externel_lb invocation, napi_disable() is called again on an already-disabled NAPI context, causing a deadlock on rtnl_lock() within hclge_reset_prepare(). The fix introduces use of the HNS3_NIC_STATE_DOWN state flag to guard napi_disable() and napi_enable() calls in the externel_lb path, mirroring the protection already used in ndo_stop() and ndo_start() (Red Hat Bugzilla).

Successful triggering of this vulnerability causes the affected kernel task (e.g., kworker/u321:0) to block in an uninterruptible sleep state (D state) for over 120 seconds, effectively freezing network operations on the HNS3 interface. This results in a denial-of-service condition affecting availability of network services on systems using the HNS3 driver, with no direct impact on confidentiality or integrity. The deadlock is localized to the HNS3 driver subsystem and does not facilitate privilege escalation or lateral movement (Red Hat Bugzilla).

The recommended remediation is to update to a patched Linux kernel version that includes the fix for this deadlock (patches are available via stable kernel commits referenced in the upstream advisory at lore.kernel.org). SUSE has issued kernel security updates addressing this CVE (e.g., SUSE-2026-0281-1 and SUSE-2026-20876-1). As a workaround, administrators should avoid triggering concurrent external load balancing and reset operations on HNS3 network interfaces until the patch is applied (Red Hat Bugzilla).