CVE-2023-54236: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54236 is a vulnerability in the Linux kernel's net/net_failover subsystem where the failover device's TX queue count mismatch can trigger a kernel warning. Specifically, the failover device is initialized with 16 TX queues by default, but when the primary device has more TX queues (e.g., 18), packet transmission from the failover device selects a queue index exceeding the failover device's actual queue count, producing the warning: eth0 selects TX queue 18, but real number of TX queues is 16. The vulnerability was published on December 30, 2025, and affects the Linux kernel (Feedly). The EPSS score is approximately 0.032% (low), indicating limited exploitation probability (Feedly).

The root cause is an improper synchronization between the failover device's TX queue count and the primary device's TX queue count (CWE-682 or related incorrect calculation/resource management). When a packet is transmitted via the failover device and the primary device is UP and running, the kernel's net_failover logic selects the TX queue based on the primary device's queue index without validating it against the failover device's configured queue limit of 16. This results in netdev_core_pick_tx emitting a warning when the selected queue index exceeds the failover device's real TX queue count. The fix involves adjusting the failover device's TX queue count to match the primary device's queue count, as addressed in multiple stable kernel commits (Kernel Git, Kernel Git).

The primary impact of this vulnerability is a kernel warning that may indicate incorrect TX queue selection in the net_failover driver, which could lead to degraded network performance or unexpected behavior in virtualized environments using KVM with failover networking. In the worst case, this could cause packet misrouting or network instability on affected systems. The availability of the network interface may be affected, but there is no evidence of confidentiality or integrity compromise (Feedly).

Apply the upstream Linux kernel patches that fix the TX queue count synchronization in net/net_failover. The fixes are available in multiple stable kernel branches via the following commits: 2d5cebf, 44d250c, 105cc26, c942f5c, and e3cbdcb. Users running KVM-based virtualized environments with net_failover and primary devices with more than 16 TX queues should prioritize updating their kernel to a patched version. Red Hat and other Linux distributions may provide backported fixes through their respective security channels (Vulners/RedHat).