CVE-2023-54028: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54028 is a Linux kernel vulnerability in the RDMA/rxe (RoCE software implementation) subsystem involving improper cleanup of an uninitialized spinlock during Queue Pair (QP) creation error handling. The flaw exists in rxe_create_qp(), where an error occurring before rxe_qp_init_req() is called causes the unwind path to invoke rxe_cleanup_task() on an uninitialized spinlock, resulting in a kernel oops. It affects Linux kernel versions from commit 8700e3e7c485 up to the backported fixes in stable branches. The CVE was published on December 24, 2025, and NVD has not yet assigned a CVSS score; Feedly estimates the severity as Medium with an EPSS score of 0.000180 (Feedly, CVE.org).

The root cause is a use-before-initialization bug (related to CWE-908: Use of Uninitialized Resource) in the RDMA/rxe subsystem's QP creation path. In rxe_create_qp(), the function rxe_qp_from_init() is called to initialize the QP structure; however, rxe_init_task() — which sets up the spinlock used by rxe_cleanup_task() — is not invoked until rxe_qp_init_req(). If any error occurs between these two points, the error-handling unwind path calls rxe_cleanup() → rxe_qp_do_cleanup() → rxe_cleanup_task(), which attempts to access the uninitialized spinlock and triggers a kernel oops. The fix ensures that rxe_cleanup_task() is only called if rxe_init_task() has previously been executed, preventing the invalid memory access (CVE.org, Feedly).

Successful triggering of this vulnerability causes a kernel oops (panic/crash) in the RDMA/rxe subsystem, resulting in a denial of service for the affected system. The impact is primarily an availability concern — a local user or process with access to RDMA/rxe QP creation (e.g., via InfiniBand/RoCE interfaces) could crash the kernel by inducing an error during QP initialization. There is no evidence of confidentiality or integrity impact, and the vulnerability does not appear to enable privilege escalation or remote code execution (Feedly, CVE.org).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed commits include:

• 0d938264fcfe (stable branch)
• 3236221bb8e4 (stable branch)
• b2b1ddc45745 (stable branch)
• c8473cd5b301 (stable branch)

Patched versions include Linux 6.1.32, 6.2.15, 6.3.2, and 6.4. Users should update to a kernel version containing these fixes. As a workaround, systems that do not use RDMA/rxe (software RoCE) can unload or disable the rdma_rxe kernel module to eliminate exposure (CVE.org, Feedly).