CVE-2023-54048: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54048 is a race condition vulnerability in the Linux kernel's RDMA bnxt_re driver that can lead to a kernel panic (use-after-free scenario). The flaw arises because the hardware may generate completions after a Queue Pair (QP) is destroyed, causing the driver to schedule completion handlers on an already-freed Completion Queue (CQ). Affected Linux kernel versions include those prior to the stable patches at 5.15.124, 6.1.43, 6.4.8, and 6.5. The vulnerability was published on December 24, 2025, with an EPSS score of approximately 0.018% (very low), and no CVSS base score has been formally assigned (Feedly, EUVD).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-362) in the bnxt_re RDMA driver within the Linux kernel. When a QP is destroyed, the associated CQs remain active, allowing the driver to continue scheduling completion handlers (bnxt_re_poll_cq) even after the CQ memory has been freed. This results in a poll_cq call executing concurrently with destroy_cq, leading to a kernel panic as evidenced by the call trace: bnxt_re_poll_cq → __ib_process_cq → ib_cq_poll_work → process_one_work. The fix ensures all pending completion handlers are drained before destroy_qp returns, so that a subsequent free_cq call causes the IB stack to cancel CQ work before invoking the destroy_cq verb (Feedly).

Successful triggering of this vulnerability causes a kernel panic, resulting in a system crash and denial of service on the affected host. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Systems using Broadcom bnxt_re RDMA adapters (e.g., in high-performance computing or data center environments) are at risk, particularly when the driver is repeatedly loaded and unloaded (Feedly).

The Linux kernel community has released fixes in the following stable versions: 5.15.124, 6.1.43, 6.4.8, and 6.5. Administrators should update their Linux kernel to one of these patched versions or later. The relevant upstream commits are available at the kernel stable repository (commits b79a0e71, b8500538, 7faa6097, and b5bbc655). SUSE has also issued kernel advisories incorporating this fix. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (Feedly, Linux Security SUSE).