CVE-2023-54003: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54003 is a resource leak vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) core subsystem, specifically in the create_ah (Address Handle creation) code path. When an AH create request fails, the sgid_attr (source GID attribute) reference is not properly released, resulting in a GID entry reference leak that is reported when the GID table is later released. The vulnerability affects Linux kernel versions from 4.19 up through multiple stable branches prior to their respective fixes (5.4.241, 5.10.178, 5.15.108, 6.1.25, 6.2.12, and 6.3). It was published to NVD on December 24, 2025. No CVSS score has been assigned by NVD at this time (Feedly).

The root cause is a missing reference count decrement (resource leak, CWE not formally assigned by NVD) in the RDMA/core subsystem's address handle creation path. When rdma_create_ah() or equivalent fails partway through initialization, the code path does not call rdma_put_gid_attr() on the sgid_attr pointer, leaving the GID table entry's reference count elevated. This prevents proper cleanup when the GID table is torn down, as the kernel detects the leaked reference and reports it. The bug was introduced at commit 1a1f460ff151710289c2f8d4badd8b603b87d610 and is fixed across six stable kernel branches (kernel.org patches).

The primary impact of this vulnerability is a kernel resource leak affecting availability and stability of systems using RDMA-capable hardware (e.g., InfiniBand or RoCE adapters). The leaked GID table reference can cause kernel warnings or errors during GID table teardown, potentially leading to system instability or denial-of-service conditions in environments that heavily use RDMA networking. There is no known confidentiality or integrity impact, and the vulnerability does not enable remote code execution or privilege escalation (Feedly).

Apply the upstream kernel patches that fix the missing sgid_attr release in the RDMA/core create_ah error path. Fixed versions are available in the following stable kernel releases: 5.4.241, 5.10.178, 5.15.108, 6.1.25, 6.2.12, and 6.3. Administrators should update to a patched kernel version appropriate for their distribution. If immediate patching is not possible and RDMA functionality is not required, disabling RDMA kernel modules (e.g., ib_core) can mitigate exposure (kernel.org patches).