CVE-2023-54004: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54004 is a NULL pointer dereference vulnerability in the Linux kernel's UDP-Lite (UDPLITE) protocol implementation, specifically in the __sk_mem_raise_allocated() function. The flaw is triggered when a socket is created using IPPROTO_UDPLITE (0x88) and the kernel attempts to access an uninitialized .sysctl_wmem_offset or .sysctl_rmem field in the protocol structure. It was published on December 24, 2025, and affects the Linux kernel across multiple stable branches. The CVSS score has not been formally assigned in available sources, and the CVE status is listed as "Unknown" (Feedly, CVE.org).

The root cause is a missing initialization of the .sysctl_wmem_offset (or .sysctl_rmem) field in udplite_prot and udplitev6_prot protocol structures (CWE-476: NULL Pointer Dereference). When a process creates an IPPROTO_UDPLITE socket and memory allocation is attempted via __sk_mem_raise_allocated(), the kernel calls sk_get_rmem0(), which dereferences a NULL or non-canonical pointer because the sysctl offset was never set. A prior related fix (commit c915fe13cbaa, "udplite: fix NULL pointer dereference") addressed the .memory_allocated field, but this variant remained. The fix aligns UDPLITE to use the same .sysctl_wmem_offset as UDP, resolving the dereference (Feedly, Linux Kernel Stable).

Successful exploitation causes a general protection fault (kernel panic / system crash), resulting in a denial of service (DoS) of the affected Linux system. The vulnerability impacts availability; there is no evidence of confidentiality or integrity impact, and no lateral movement or data exfiltration capability has been identified. The crash is reproducible by any local user with the ability to create raw or UDPLITE sockets, which may be possible in unprivileged contexts depending on kernel configuration (Feedly).

1. Identify target: Confirm the target Linux system is running a vulnerable kernel version with UDPLITE support enabled and that the user has socket creation privileges.
2. Create UDPLITE socket: Execute a system call to create an IPv6 UDPLITE socket: socket(AF_INET6, SOCK_DGRAM | SOCK_NONBLOCK, IPPROTO_UDPLITE) (protocol value 0x88).
3. Trigger memory allocation path: Attempt to send data or otherwise trigger the __sk_mem_raise_allocated() code path on the newly created socket.
4. Observe kernel crash: The kernel dereferences a NULL/non-canonical pointer in sk_get_rmem0() at net/core/sock.c:3006, resulting in a general protection fault and system crash (denial of service) (Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing general protection fault with a reference to sk_get_rmem0 or __sk_mem_raise_allocated in the stack trace; KASAN output indicating null-ptr-deref in range [0x0000000000000000-0x0000000000000007].
• Process: Unexpected system crashes or kernel panics on systems where UDPLITE sockets are being created; syzbot-style reproducer processes (syz-executor) or unusual processes creating IPPROTO_UDPLITE (protocol 0x88) sockets.

Apply the upstream Linux kernel patches that set .sysctl_wmem_offset for udplite_prot and udplitev6_prot to match the UDP protocol structure. Fixes are available in multiple stable kernel branches via commits at git.kernel.org (e.g., 2a112f04629f, 7e3ae83371a4, 387bd0a3af3b, 5014b64e369b, ad42a35bdfc6). As a temporary workaround, administrators can restrict unprivileged socket creation using seccomp, AppArmor, or SELinux policies to prevent untrusted users from creating UDPLITE sockets (Linux Kernel Stable, Feedly).