CVE-2023-54090: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54090 is a kernel panic vulnerability in the Linux kernel's ixgbe (Intel 10 Gigabit Ethernet) driver that causes a system crash when XDP_TX is used on systems with more than 64 CPUs. The flaw was introduced by commit 4fe815850bdc ("ixgbe: let the xdpdrv work with more than 64 cpus"), which added support for XDP programs on systems with more than 64 CPUs but contained a bug in the ixgbe_determine_xdp_q_idx function that returned the raw CPU index instead of cpu % IXGBE_MAX_XDP_QS. The vulnerability was published on December 24, 2025, and affects the Linux kernel's ixgbe driver on multi-CPU systems. It carries an EPSS score of 0.018% and no CVSS score has been publicly assigned (Feedly).

The root cause is an array-index-out-of-bounds condition (CWE-129) in the ixgbe network driver. When ixgbe_determine_xdp_q_idx is called on a system with more than 64 CPUs, it incorrectly returns the raw CPU number (e.g., 65) instead of applying the modulo operation (cpu % IXGBE_MAX_XDP_QS), causing ixgbe_determine_xdp_ring in ixgbe.h to access an out-of-bounds index in the ixgbe_ring *[64] array. This triggers a UBSAN array-index-out-of-bounds error followed by a kernel NULL pointer dereference, resulting in a kernel panic. The bug manifests specifically during XDP TX operations on systems with CPU IDs ≥ 64 (i.e., CPU 65 and above) (Feedly).

Successful triggering of this vulnerability causes a kernel panic (system crash), resulting in a complete loss of availability for the affected host. The crash occurs in kernel mode during network packet processing via XDP TX, meaning any workload running on the system is abruptly terminated. There is no evidence of confidentiality or integrity impact; the vulnerability is purely a denial-of-service condition affecting systems running the ixgbe driver with more than 64 CPU cores (Feedly).

The Linux kernel maintainers have issued patches addressing this bug across multiple stable branches, with fixes available at the following kernel.org stable commits: 4cd43a19900d, 785b2b5b47b1, 1924450175349, and c23ae5091a8b. Users should update to a patched kernel version that includes the fix for ixgbe_determine_xdp_q_idx to correctly apply cpu % IXGBE_MAX_XDP_QS. As a temporary workaround, disabling XDP TX on ixgbe interfaces or limiting CPU affinity to fewer than 64 cores for XDP workloads can prevent the panic (Feedly).