CVE-2023-54149: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54149 is a Linux kernel vulnerability in the DSA (Distributed Switch Architecture) subsystem involving suspicious RCU (Read-Copy-Update) usage for synced VLAN-aware MAC addresses. The issue occurs in the net/dsa component when the felix driver is used as a DSA master for another DSA switch and downstream switch ports join a VLAN-aware bridge. The vulnerability was published on December 24, 2025, and affects the Linux kernel's net/8021q/vlan_core.c code path. It carries an EPSS score of 0.017% (very low), indicating minimal current exploitation probability (Feedly).

The root cause is an improper synchronization issue (related to CWE-667: Improper Locking) where vlan_for_each() is called without the required rtnl_lock() context. Specifically, dsa_slave_sync_uc() calls vlan_for_each() from within dsa_slave_set_rx_mode(), which is invoked from the deferred workqueue dsa_slave_switchdev_event_work — a context that deliberately avoids rtnl_lock() as established by a prior commit (0faf890fc519). This results in a suspicious rcu_dereference_protected() warning from lockdep, as the RCU read-side critical section assumptions are violated. The call stack involves: dsa_slave_switchdev_event_work → dsa_port_bridge_host_fdb_add → dev_uc_add → dsa_slave_set_rx_mode → dsa_slave_sync_uc → vlan_for_each (Feedly).

The primary impact is a kernel warning/instability rather than direct privilege escalation or data exfiltration. The suspicious RCU usage can lead to undefined behavior in the kernel's memory management, potentially causing kernel crashes or data corruption in networking subsystems on systems using the felix DSA driver with VLAN-aware bridge configurations. Availability is the most affected CIA dimension, as kernel instability could result in denial of service on affected network devices (Feedly).

The fix is available as patches in the Linux kernel stable tree, with commits 3f9e79f31e51, 3948c69b3837, and d06f925f1397 addressing the issue by ensuring proper locking context when vlan_for_each() is called from the DSA subsystem. Users should update to a patched Linux kernel version that includes these fixes. Red Hat has also tracked this issue (RH:CVE-2023-54149), so users of RHEL-based distributions should apply available kernel updates from their vendor (Feedly, Vulners RedHat).