CVE-2023-54262: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54262 is a use-after-free vulnerability in the Linux kernel's net/mlx5e (Mellanox Ethernet) driver, specifically in the TC (Traffic Control) post-action flow attribute handling code. The flaw arises because mlx5e_tc_post_act_add() erroneously creates a second clone of flow post-action attributes that were already cloned in mlx5e_clone_flow_attr_for_post_act(), resulting in a copy that is not properly updated during neighbor (neigh) update operations, leading to a use-after-free condition. The vulnerability was published on December 30, 2025, and affects the Linux kernel. It carries an EPSS score of approximately 0.018% (very low), and no CVSS score has been publicly assigned at this time (CVE Record, Vulners).

The root cause is a use-after-free (CWE-416) in the Linux kernel's net/mlx5e TC offload subsystem. When mlx5e_tc_post_act_add() creates a redundant second copy of flow post-action attributes (already cloned by mlx5e_clone_flow_attr_for_post_act()), the second copy is not updated during neighbor table update events. This leaves a stale pointer that is subsequently accessed, triggering a KASAN-detected use-after-free in mlx5_cmd_set_fte(). The fix assigns handle->attribute directly to the post_attr provided by the caller rather than allocating a new copy. The vulnerability is local in nature, requiring the ability to configure TC flow rules on a system with an mlx5e-based Mellanox NIC (CVE Record, Infinitsec).

Successful exploitation of this use-after-free vulnerability can lead to kernel memory corruption, potentially causing a system crash (denial of service) or, in more severe scenarios, privilege escalation or arbitrary code execution in kernel context. The affected component is the mlx5e network driver used with Mellanox/NVIDIA ConnectX NICs, so systems using these adapters with TC offload rules are at risk. The primary impact is availability (kernel panic/crash), though memory corruption bugs of this class can sometimes be leveraged for privilege escalation by a local attacker (CVE Record, Infinitsec).

• Logs: Kernel logs containing BUG: KASAN: use-after-free in mlx5_cmd_set_fte or related KASAN stack traces involving mlx5_core module.
• Logs: Kernel oops or panic messages referencing mlx5e_tc_post_act_add or mlx5e_clone_flow_attr_for_post_act in the call stack.
• Process/System: Unexpected system crashes or kernel panics on hosts equipped with Mellanox/NVIDIA ConnectX NICs running TC offload rules.

The Linux kernel maintainers have addressed this vulnerability through patches applied to stable kernel branches. The fix modifies mlx5e_tc_post_act_add() to assign handle->attribute directly to the caller-provided post_attr instead of creating a redundant clone. Users should update to a patched Linux kernel version that includes the relevant commits (e.g., 2d57a514f9ab, 8fd1dac646e6, c382b693ffcb, e9fce818fe00 in the stable tree). As a workaround, disabling TC hardware offload on mlx5e interfaces (ethtool -K <iface> hw-tc-offload off) can mitigate the risk until a patched kernel is applied (Kernel Git, Tenable).