CVE-2023-54106: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54106 is a memory leak vulnerability in the Linux kernel's MLX5 network driver, specifically within the mlx5e_init_rep_rx function. The flaw occurs because memory referenced by the priv->rx_res pointer is not freed in the error path of the initialization routine, potentially enabling a local attacker to exhaust system memory. It affects Linux kernel versions prior to the fixes introduced in kernel 6.1.45, 6.4.10, 6.5, and the 6.0 stable series. The vulnerability was publicly disclosed on December 24, 2025, and carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the mlx5e_init_rep_rx function of the Linux kernel's net/mlx5 driver. When an error occurs during initialization, the function exits without freeing the memory allocated for priv->rx_res, whereas the corresponding cleanup function mlx5e_cleanup_rep_rx() correctly releases this memory. The fix aligns the error path with the cleanup function to ensure the pointer is always freed on failure. Exploitation requires local access with low privileges and high attack complexity, as the attacker must be able to trigger the error path repeatedly (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation by a low-privileged local attacker could cause progressive memory exhaustion on affected systems, leading to performance degradation, system instability, or denial of service conditions. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, though the primary practical risk is availability — repeated triggering of the error path could deplete kernel memory resources. There is no indication of data exfiltration or lateral movement potential directly associated with this vulnerability (Red Hat Advisory, Red Hat Bugzilla).

Apply the upstream kernel patches that fix the error path in mlx5e_init_rep_rx. Fixed versions include Linux kernel 6.1.45, 6.4.10, 6.5, and the corresponding 6.0 stable patch (commits 0582a3caaa3e, c265d8c2e255, and c6cf0b6097bf). Users should update to a patched kernel version provided by their Linux distribution. As an interim measure, monitoring system memory usage and limiting local user access to systems with MLX5 network hardware can reduce risk (Red Hat Bugzilla, Red Hat Advisory).