CVE-2023-54031: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54031 is a vulnerability in the Linux kernel's vDPA (virtio Data Path Acceleration) subsystem involving a missing netlink attribute policy entry that can lead to an out-of-bounds (OOB) read. The flaw exists because the vdpa_nl_policy structure lacked a policy entry for the vDPA queue index attribute (VDPA_ATTR_DEV_QUEUE_INDEX), allowing a malformed netlink message to produce an illegal nlattr pointer after parsing. This is analogous to CVE-2023-3773, which exploited a similar missing policy in the same subsystem. Affected Linux kernel versions span from 5.19 up to (but not including) the patched stable releases: 6.1.47, 6.4.12, and 6.5. The CVE was published on December 24, 2025; no CVSS score has been assigned by NVD at this time (Feedly, CVE.org).

The root cause is a missing nla_policy entry for the VDPA_ATTR_DEV_QUEUE_INDEX attribute in the vdpa_nl_policy array, which is used by the kernel's generic netlink infrastructure to validate incoming netlink message attributes. Without this policy entry, the netlink parser does not enforce length or type constraints on the queue index attribute, potentially yielding an invalid or out-of-bounds nlattr pointer that is subsequently dereferenced by handlers in vdpa_nl_ops. This constitutes an improper input validation / out-of-bounds read condition (analogous to CWE-125). Exploitation requires the ability to send crafted netlink messages to the vDPA subsystem, which typically requires CAP_NET_ADMIN or equivalent privileges on the target system (Feedly, CVE.org).

Successful exploitation of this vulnerability could allow a local privileged attacker to trigger an out-of-bounds read in kernel memory, potentially leading to information disclosure of sensitive kernel data or a kernel panic (denial of service). Because the read occurs in kernel context, leaked memory could include cryptographic material, pointers, or other sensitive data that could facilitate further privilege escalation. The impact is limited to systems where the vDPA kernel module is loaded and the attacker has sufficient privileges to interact with the netlink interface (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in stable branches. The fix adds the missing nla_policy entry for VDPA_ATTR_DEV_QUEUE_INDEX to vdpa_nl_policy. Patched commits are available for kernel versions 6.1.47 (8ad9bc25cbdc), 6.4.12 (b3003e1b54e0), and 6.5 (ccb533b7070a). Users should update to a patched kernel version; distributions such as SUSE have also issued advisories incorporating these fixes. As a workaround, restricting access to netlink interfaces (e.g., via Linux namespaces or capability restrictions) can reduce exposure (Feedly, CVE.org).