CVE-2023-54114: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54114 is a denial-of-service vulnerability in the Linux kernel's Network Service Header (NSH) Generic Segmentation Offload (GSO) handling, specifically in the nsh_gso_segment() function. The flaw causes a kernel panic (skb_panic) due to an incorrect mac_header calculation during error unwinding when an inner-layer protocol GSO (e.g., MPLS) fails and resets skb->network_header. It affects the Linux kernel and was publicly disclosed on December 24, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) lies in nsh_gso_segment(), which calculates nhoff as skb->network_header - skb->mac_header before pulling the NSH header. When an inner-layer GSO function such as mpls_gso_segment() calls skb_reset_network_header() and then returns -EINVAL, the error-unwind path in skb_gso_error_unwind() uses the now-stale network_header value to restore mac_header, producing a value larger than the actual skb headroom. The subsequent skb_push() call detects this inconsistency and triggers skb_panic. Exploitation requires a local attacker with low privileges to send crafted network packets through the NSH/MPLS stack (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes a kernel panic, resulting in a complete system crash and denial of service. There is no confidentiality or integrity impact — the vulnerability is limited to availability. A local user with low privileges can crash the host, potentially disrupting all services running on the affected system (Red Hat CVE, Red Hat Bugzilla).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI followed by a call trace involving skb_panic, skb_push, nsh_gso_segment, skb_mac_gso_segment, and __skb_gso_segment.
• Process: Unusual processes sending raw network packets (e.g., via packet_sendmsg) that trigger NSH/MPLS GSO paths, potentially identifiable via strace or audit logs.
• System: Unexpected system reboots or kernel panics on hosts processing NSH-encapsulated network traffic.

The fix involves using a saved mac_offset value (rather than recomputing it from the potentially modified network_header) to correctly restore mac_header in the error-unwind path of nsh_gso_segment(). Patches have been committed to the stable Linux kernel tree across multiple stable branches (referenced at git.kernel.org). Users should update their Linux kernel to a patched version as soon as one is available for their distribution. As interim mitigations, administrators can restrict local user access, implement strict network packet filtering to limit NSH traffic, and monitor kernel logs for panic-related events (Red Hat Bugzilla, Red Hat CVE).