CVE-2023-54148: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54148 is a use-after-free vulnerability in the Linux kernel's net/mlx5e driver, specifically in the representor neighbor (neigh) cleanup path for IP tunnel encapsulation in ECMP (Equal-Cost Multipath) mode. The flaw arises when an eswitch unpair operation occurs during driver unload, causing neighbor information to be freed in profile->disable before it is accessed in profile->cleanup_tx, triggering a KASAN-detected slab-use-after-free error. It was published on December 24, 2025, and affects the Linux kernel (vendor: linux, product: kernel). The EPSS score is approximately 0.017% (very low), and no CVSS score has been publicly assigned at this time (CVE Record, Feedly).

The root cause is a use-after-free (CWE-416) in the mlx5e_rep_neigh_entry_release function within the Linux kernel's mlx5 Ethernet driver. When operating in ECMP mode with IP tunnel encapsulation, neighbor information for the peer uplink representor is created during flow offload. A prior commit moved eswitch devcom unpair to profile->cleanup_tx, but the neighbor cleanup remained in profile->disable, which executes earlier. When one eswitch unpairs (e.g., during driver unload via modprobe), the peer rule deletion attempts to access already-freed neighbor info, triggering the use-after-free. The fix moves neigh cleanup to profile->cleanup_tx (after mlx5e_cleanup_uplink_rep_tx) and neigh init to init_tx for symmetry. The KASAN report identifies a read of size 4 at a freed slab address in task modprobe (CVE Record).

Successful triggering of this vulnerability causes a kernel use-after-free condition, which can result in system instability or a kernel panic (denial of service). In more severe scenarios, use-after-free bugs in the kernel can potentially be leveraged for local privilege escalation or arbitrary kernel memory read/write, though no such exploitation has been demonstrated for this specific CVE. The affected scope is limited to Linux systems using Mellanox/NVIDIA mlx5 NICs configured with ECMP IP tunnel encapsulation and eswitch representors (CVE Record).

The fix has been committed to the Linux kernel stable tree, moving the neighbor cleanup to profile->cleanup_tx (after mlx5e_cleanup_uplink_rep_tx) and neighbor init to init_tx. Administrators should apply the relevant kernel patches referenced in the upstream stable commits (e.g., 36697c592cd0, d03b6e6f3182, d628ba98eb16). Distributions shipping affected kernel versions should update to patched releases as they become available. As a workaround, avoiding ECMP IP tunnel encapsulation with mlx5 eswitch representors may reduce exposure until a patched kernel is deployed (CVE Record, Kernel Git).