CVE-2023-54156: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54156 is a NULL pointer dereference vulnerability in the Linux kernel's sfc (Solarflare) network driver that can cause a kernel crash when network statistics are read while the NIC is undergoing a reset. The flaw exists in the efx_net_stats() function (.ndo_get_stats64), which may be called during an ethtool selftest at a time when nic_data->mc_stats is NULL because the NIC has been finalized. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from the introduction of the vulnerable code (commit d3142c193dca) up to the respective stable-branch fix commits. No CVSS score has been assigned by NVD at this time; the ENISA database records a base score of 0.0, indicating scoring is pending (ENISA EUVD, Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the Linux kernel's sfc driver. During an ethtool selftest, efx_ef10_fini_nic() frees nic_data->mc_stats and sets it to NULL, but efx_net_stats() / efx_ef10_update_stats_pf() can be called concurrently (e.g., via dev_get_stats() → dev_seq_printf_stats()) without checking for this NULL condition, resulting in a kernel BUG at address 0x0000000000000038. A secondary race condition (TOCTTOU) exists between the free in efx_ef10_fini_nic() and the stats update path; the fix addresses both issues by skipping the hardware stats read when mc_stats is NULL and by acquiring efx->stats_lock in fini_nic() to serialize access (ENISA EUVD, Kernel Patch 1).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic (BUG) and system crash, which constitutes a denial-of-service condition. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. The vulnerability is local in nature, typically requiring the ability to trigger an ethtool selftest on a system using a Solarflare (sfc) NIC while a NIC reset is in progress (ENISA EUVD, Feedly).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries showing BUG: kernel NULL pointer dereference, address: 0000000000000038 with a call trace including efx_nic_update_stats, efx_ef10_update_stats_pf, efx_net_stats, dev_get_stats, and dev_seq_printf_stats.
• System Behavior: Unexpected system crash or kernel panic on hosts equipped with Solarflare (sfc) NICs, particularly occurring during or shortly after an ethtool selftest or NIC reset operation.

Apply the upstream kernel patches that fix the NULL pointer dereference and the associated TOCTTOU race condition in the sfc driver. Fixes have been backported to multiple stable branches: Linux 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, and 6.5. The relevant upstream fix commits are cb1aa7cc, 91f4ef20, 446f5567, 470152d7, aba32b4c, and d1b35543. As a workaround, avoid running ethtool selftests on Solarflare NICs during periods of NIC reset activity until the patch is applied. Distributions using affected kernel versions should apply vendor-provided kernel updates (ENISA EUVD, Kernel Patch 1).