CVE-2023-54223: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54223 is a vulnerability in the Linux kernel's net/mlx5e driver related to invalid buffer access in the XSK (AF_XDP) path for legacy receive queues (RQ). When using xdpsock in RX mode with legacy RQ, a buffer can be released twice — once in the XDP_REDIRECT path and again in the driver — leading to a general protection fault (kernel crash). The vulnerability was published on December 30, 2025, and affects the Linux kernel. It carries an estimated CVSS severity of Medium, with an EPSS score of approximately 0.018% (Feedly).

The root cause is a double-free / invalid buffer access (CWE-415) in the net/mlx5e XSK legacy RQ handling. XSK buffer management for legacy RQ previously relied on the caller setting a "skip release" flag to prevent double-freeing; however, a prior fix changed the buffer lifecycle to use fragment counts for pages instead of the skip flag, breaking this assumption. As a result, when a packet is redirected via XDP_REDIRECT, the buffer is freed in the redirect path, and the driver subsequently attempts to free it again, causing a general protection fault with a non-canonical address access (0xffff8881217e3a) (Feedly). The fix sets the appropriate flag on the driver side to prevent the redundant release.

Successful triggering of this vulnerability causes a kernel general protection fault, resulting in a system crash (denial of service). The crash occurs in the ksoftirqd kernel thread context, meaning it can be triggered by network traffic processing on systems using Mellanox/NVIDIA mlx5e NICs with AF_XDP (XSK) in legacy RQ mode. There is no evidence of confidentiality or integrity impact beyond the availability loss caused by the kernel panic (Feedly).

The fix is available as a kernel patch in the stable tree, referenced by commits 58a113a35846d9a5bd759beb332e551e28451f09 and e0f52298fee449fec37e3e3c32df60008b509b16 on kernel.org. Users should update to a patched Linux kernel version that includes these commits. As a workaround, avoiding the use of AF_XDP (XSK) in legacy RQ mode with mlx5e NICs will prevent the crash from occurring (Feedly, Kernel Patch 1, Kernel Patch 2).