CVE-2023-54161: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54161 is a null-pointer dereference / use-after-free vulnerability in the Linux kernel's Unix domain socket (af_unix) implementation, specifically in the unix_stream_sendpage() function. It was reported by Bing-Jhong Billy Jheng and disclosed on December 24, 2025. The vulnerability affects Linux kernel versions prior to 6.5, where the sendpage() refactoring that inadvertently resolved the issue had not yet been applied. Notably, this CVE ID has been marked as Rejected by its CVE Numbering Authority. The associated CVSS v3.1 base score is 5.5 (Medium), reflecting a local attack vector with high availability impact (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-362 / CWE-476) in unix_stream_sendpage(), which attempts to append data to the last SKB (Socket Buffer) in a peer socket's receive queue without holding the queue lock. When a peer's file descriptor is passed through another socket and a circular reference is formed, closing both sockets triggers garbage collection, which unlinks SKBs from the receive queue under the queue lock. Concurrently, unix_stream_sendpage() can access the same SKB locklessly, resulting in a use-after-free condition. The fix, originally authored by Linus Torvalds, requires unix_stream_sendpage() to lock the peer's receive queue before accessing it. The issue does not exist in kernel 6.5 and later due to the sendpage() refactoring that restructured this code path (Red Hat Bugzilla).

Successful exploitation can cause a kernel panic or system crash (denial of service) due to the use-after-free condition triggered during garbage collection of Unix domain sockets. The availability impact is rated High, while confidentiality and integrity are unaffected. A local attacker with low privileges could craft a socket loop scenario to trigger the race condition, potentially destabilizing the system; privilege escalation is considered a secondary risk given the memory corruption nature of the bug (Red Hat Bugzilla, Red Hat Advisory).

1. Setup: Obtain low-privileged local access to a Linux system running a kernel version prior to 6.5.
2. Create socket loop: Create two Unix domain stream sockets and pass each socket's file descriptor to the other via SCM_RIGHTS ancillary messages, forming a circular reference.
3. Trigger garbage collection: Close both sockets without receiving the passed file descriptors, causing the kernel's garbage collector to iterate and unlink SKBs from the receive queues under the queue lock.
4. Race condition: Concurrently invoke unix_stream_sendpage() on one of the sockets so that it accesses the SKB in the peer's receive queue without holding the lock, racing with the garbage collector's cleanup.
5. Achieve use-after-free: The lockless access to the freed SKB triggers a null-pointer dereference or use-after-free, resulting in a kernel page fault and system crash (denial of service) (Red Hat Bugzilla).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing BUG: unable to handle page fault for address with a call trace involving unix_stream_sendpage, kmem_cache_alloc_node, or __alloc_skb.
• Process: Unusual processes repeatedly creating and closing Unix domain socket pairs, or processes named after exploit tooling (e.g., garbage_uaf as seen in the reported reproducer).
• System Behavior: Unexpected kernel panics or system reboots on hosts running kernel versions prior to 6.5, particularly on systems with active Unix domain socket usage (Red Hat Bugzilla).

The issue is resolved in Linux kernel version 6.5 and later as a side effect of the sendpage() refactoring; upgrading to kernel 6.5+ is the primary remediation. For systems running earlier kernel versions, vendor-specific backported patches should be applied — Red Hat has tracked this via Bugzilla #2425149 with a patch referenced from the upstream kernel CVE announcement. As interim mitigations, administrators should limit local user access to critical system resources, implement strict socket management policies, and monitor kernel logs for anomalous page fault traces (Red Hat Bugzilla, Red Hat Advisory).

The CVE was detected by Nessus (plugin 279828) and tracked by Vulners and VulDB shortly after disclosure. Red Hat assigned it a low severity/priority rating in their Bugzilla tracker. The CVE Numbering Authority subsequently rejected the CVE ID, which may reduce its visibility in vulnerability management workflows. No significant public researcher commentary or media coverage has been identified beyond standard database entries (Red Hat Bugzilla, Tenable).