CVE-2023-54126: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54126 is a Linux kernel vulnerability in the SafeXcel (crypto_safexcel) crypto driver that causes improper cleanup of ring IRQ workqueues when the driver fails to load. When the driver's probe fails (e.g., with error -2), IRQ affinity and associated workqueues are not correctly torn down, resulting in a kernel WARNING in kernel/irq/manage.c during boot. The affected component is the crypto: safexcel subsystem of the Linux kernel. It was published on December 24, 2025, with a patch available through Linux kernel stable updates (Red Hat CVE, Red Hat Bugzilla). No CVSS score has been officially assigned at this time.

The root cause is improper resource cleanup (CWE-459: Incomplete Cleanup) in the SafeXcel crypto driver's probe failure path. When crypto_safexcel fails to initialize — for example, on hardware such as the MikroTik RB5009 — the driver exits without calling the necessary cleanup routines for IRQ affinity and kernel workqueues associated with each crypto ring. This triggers a WARNING at kernel/irq/manage.c:1913 in free_irq() during subsequent teardown, as the IRQ is freed without its affinity having been properly released. The fix ensures that on any probe failure, the driver explicitly cleans up ring IRQ workqueues before returning (Red Hat CVE). Patch commits are available in the Linux kernel stable tree (e.g., 0a89d4a075524cf1f865cfdbb9cf38ab8e3e5409, 4d9d2fd86766ee3ec077c011aa482e85b6c9595c, 4f4de392f4926820ec1fd3573a016c704a68893d, 09e177d6f7edd0873a63f51abe914902ec0f4400).

The vulnerability can cause kernel warning messages during system boot and may result in resource leaks — specifically, unreleased IRQ affinity and workqueue resources — when the SafeXcel crypto driver fails to load. This primarily affects system stability and interrupt management for cryptographic operations on Linux systems using the SafeXcel hardware crypto accelerator (e.g., certain MikroTik and similar embedded/network devices). There is no evidence of confidentiality or integrity impact; the primary risk is availability degradation through potential resource exhaustion or unstable interrupt handling (Red Hat CVE).

• Logs: Kernel boot log (dmesg or /var/log/kern.log) containing crypto-safexcel: probe of <address>.crypto failed with error -2 followed by WARNING: CPU: ... at kernel/irq/manage.c:1913 free_irq+0x300/0x340.
• Logs: Presence of Tainted: G W kernel taint flag in crash/warning output, indicating a non-fatal kernel warning has been triggered.
• Process: Warning generated in the context of systemd-udevd during device initialization at boot.

The recommended remediation is to update to a Linux kernel version that includes the fix for CVE-2023-54126, available through Linux kernel stable tree patch commits (0a89d4a, 4d9d2fd, 4f4de39, 09e177d). Red Hat has tracked this via Bugzilla #2425169. As a temporary workaround, administrators can consider disabling or blacklisting the crypto_safexcel kernel module (/etc/modprobe.d/blacklist.conf) on affected hardware if the SafeXcel crypto accelerator is not required. Monitoring system boot logs for the associated kernel warning can help identify affected systems (Red Hat CVE, Red Hat Bugzilla).