CVE-2023-54074: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54074 is a vulnerability in the Linux kernel's net/mlx5e (Mellanox Ethernet) driver related to incorrect use of the encap attribute during encap invalidation. Specifically, the mlx5e_invalidate_encap() function fails to use the correct encap attribute when destroying modify header actions, leading to a kernel warning. The issue was introduced after the post-action infrastructure was added, which changed how encap attributes are retrieved (via mlx5e_tc_get_encap_attr()), but mlx5e_invalidate_encap() was not updated accordingly. It was published on December 24, 2025, and has a low EPSS score of 0.017%, indicating minimal exploitation likelihood (Feedly, Tenable).

The root cause is an incorrect pointer dereference in the mlx5e_invalidate_encap() function within drivers/net/ethernet/mellanox/mlx5/core/en_tc.c. When the post-action infrastructure was introduced, most callers were updated to use mlx5e_tc_get_encap_attr() to retrieve the correct flow attribute, but mlx5e_invalidate_encap() was overlooked, causing it to operate on the default (incorrect) attribute. This results in a kernel WARN_ON triggered in mlx5e_tc_attach_mod_hdr() at line 684 of en_tc.c when the modify header action cannot be properly destroyed. The fix involves updating mlx5e_invalidate_encap() to call the correct helper to obtain the proper encap attribute before proceeding with invalidation (Feedly).

The primary impact of this vulnerability is a kernel warning (WARN_ON) that can disrupt the normal operation of the mlx5e network driver on systems using Mellanox/NVIDIA network adapters. While the warning itself does not directly lead to arbitrary code execution or privilege escalation, it indicates a logic error that could result in resource mismanagement, potential memory corruption, or system instability in affected kernel configurations. The availability of network functionality on affected hosts may be degraded, particularly in environments leveraging TC (Traffic Control) offloading with encapsulation (Feedly).

The fix is available as upstream Linux kernel patches. Administrators should apply the relevant stable kernel commits: 00959a1bad58e4b6c14a2729f84d354255073609, b8b4292fdd8818ab43b943b6717811651f51e39f, and be071cdb167fc3e25fe81922166b3d499d23e8ac (kernel.org). Users should update to a patched Linux kernel version that includes these fixes. As a temporary workaround, disabling TC hardware offloading on mlx5e interfaces may prevent the warning from being triggered, though this will impact network performance.