CVE-2023-54216: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54216 is a use-after-free vulnerability in the Linux kernel's net/mlx5e Traffic Control (TC) subsystem, specifically in the eswitch mapping logic used during NIC mode operation. The flaw occurs because the eswitch object mapping pool is accessed in NIC mode where it has not been initialized, triggering a KASAN slab-use-after-free condition. It was published on December 30, 2025, and affects the Linux kernel (vendor: linux, product: kernel). Feedly estimates the severity as Medium, with an EPSS score of 0.000180 (Feedly).

The root cause is a use-after-free (CWE-416) condition in the mlx5e driver's TC (Traffic Control) code path. When the system is operating in NIC mode (as opposed to eswitch/SR-IOV mode), the code incorrectly references the eswitch object mapping pool, which is uninitialized in that context. This results in a KASAN-detected slab-use-after-free at mlx5_add_flow_rules+0x30/0x490 within the mlx5_core kernel module, triggered when a user invokes tc (traffic control) commands. The fix involves conditionally selecting either the NIC or eswitch object mapping pool based on whether the eswitch is enabled (Feedly, Kernel Fix 1, Kernel Fix 2).

Successful exploitation of this vulnerability can cause a kernel crash or memory corruption due to the use-after-free condition, resulting in a denial of service (system instability or panic) on affected Linux systems running the mlx5_core driver in NIC mode. An attacker or unprivileged local user with access to tc (traffic control) commands could trigger the bug, potentially leading to privilege escalation or information disclosure depending on the memory state at the time of exploitation. The impact is primarily on availability and integrity of the affected host (Feedly).

The fix has been committed to the Linux kernel stable tree, correcting the mapping pool selection logic to use either the NIC or eswitch object mapping pool depending on whether the eswitch is enabled. Users should update to a patched kernel version that includes commits 4150441c010dec36abc389828e2e4758bd8ad4b3 or dfa1e46d6093831b9d49f0f350227a1d13644a2f from the stable kernel tree. As a workaround, avoiding the use of TC offload rules on systems running mlx5 hardware in NIC mode (without eswitch/SR-IOV enabled) can reduce exposure until a patched kernel is applied (Kernel Fix 1, Kernel Fix 2).