CVE-2023-54065: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-54065 is an out-of-bounds memory access vulnerability in the Linux kernel's DSA (Distributed Switch Architecture) Realtek driver (net/dsa/realtek). The flaw exists in the realtek-mdio driver, which failed to allocate trailing space for chip_data as the realtek-smi driver correctly did, leading to out-of-bounds memory accesses during probe. It was published on December 24, 2025, and affects Linux kernel versions starting from 5.18 up to (but not including) the patched releases 6.1.23 and 6.2.10. The CVSS base score is 0.0 (no severity assigned at time of publication) (Feedly, EUVD).

The root cause is an out-of-bounds write/read (CWE-787/CWE-125) in the realtek-mdio driver's probe function. The function sets priv->chip_data to (void *)priv + sizeof(*priv), assuming trailing memory has been allocated for chip-specific data — an assumption that was only valid in realtek-smi, which explicitly allocated this extra space. The realtek-mdio driver did not perform this allocation, meaning subsequent accesses to chip_data would read or write beyond the allocated kernel buffer. The bug went undetected in standard Linux because an unused buf[4096] member in struct realtek_priv caused kmalloc to round up the allocation to a size large enough to inadvertently cover the overrun; however, the corruption becomes apparent under KASAN or alternative allocators such as those used in the barebox bootloader port (Feedly).

Exploitation of this vulnerability can result in kernel memory corruption, potentially leading to system instability, kernel panics, or denial of service. In environments using alternative memory allocators or with KASAN enabled, the out-of-bounds access can corrupt adjacent kernel data structures, which may have integrity implications. The impact is limited to systems using the realtek-mdio DSA driver, which is typically found in embedded networking devices and systems with Realtek-managed switches connected via MDIO (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-54065. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access or the ability to trigger the driver probe on an affected system, significantly limiting the attack surface (Feedly).

The fix has been backported to stable Linux kernel releases: version 6.1.23 (commit cc0f9bb99735d2b68fac68f37b585d615728ce5b), version 6.2.10 (commit fe668aa499b4b95425044ba11af9609db6ecf466), and the mainline 6.3 release (commit b93eb564869321d0dffaf23fcc5c88112ed62466). The patch adds the missing chip_data allocation in realtek-mdio to match the behavior of realtek-smi. Users running affected kernel versions on systems with Realtek MDIO-connected switches should update to kernel 6.1.23, 6.2.10, 6.3, or later. Distribution-specific kernel updates should be applied as they become available (Feedly, Kernel Patch 6.1.23).