CVE-2023-54168: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54168 is a shift-wrapping vulnerability in the Linux kernel's RDMA/mlx4 subsystem, specifically within the set_user_sq_size() function. The flaw arises because the user-controlled ucmd->log_sq_bb_count variable is used in a bit-shift operation without bounds checking, allowing integer overflow via shift wrapping. It affects the Linux kernel from version 2.6.24 onward, with fixes backported to stable releases including 4.19.283, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. The vulnerability was published on December 30, 2025, with an EPSS score of approximately 0.032% (Feedly, ENISA EUVD). No CVSS base score has been formally assigned at this time.

The root cause is an integer overflow due to improper validation of a user-supplied shift amount (CWE-190: Integer Overflow or Wraparound). In set_user_sq_size() within the RDMA/mlx4 driver, the field ucmd->log_sq_bb_count is directly used as a shift operand without checking whether the resulting shift would exceed the width of the target integer type, leading to undefined behavior or wrap-around. The fix applies check_shl_overflow(), mirroring the approach used in commit 515f60004ed9 for the analogous hns_roce_set_user_sq_size() function in the RDMA/hns driver. Because the vulnerable field is populated from user-space input via an ioctl interface, a local unprivileged user with access to an RDMA device could potentially trigger this condition (Feedly, ENISA EUVD).

Exploitation of this vulnerability could result in undefined behavior in the kernel's RDMA/mlx4 driver, potentially leading to memory corruption, kernel crashes (denial of service), or in worst-case scenarios, privilege escalation if the corrupted memory state can be leveraged. The impact is limited to systems with Mellanox mlx4 RDMA hardware and requires local access to the RDMA device interface. Confidentiality and integrity impacts depend on whether the integer overflow can be reliably weaponized into a more complex memory corruption primitive (Feedly, ENISA EUVD).

The Linux kernel maintainers have released patches across multiple stable branches. Users should update to the following fixed versions or later: 4.19.283, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, or 6.4. Distribution-specific updates (e.g., SUSE kernel updates) have also been issued. As a workaround where patching is not immediately possible, restricting unprivileged user access to RDMA devices (e.g., via udev rules or removing the mlx4 module if unused) can reduce exposure (Feedly, ENISA EUVD, Linux Security).

Coverage has been limited to automated vulnerability tracking platforms and scanner vendors (Nessus, Qualys), with no notable researcher commentary or significant social media discussion identified. SUSE issued a kernel security advisory addressing this CVE among others (Linux Security).