CVE-2023-54262: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54262 is a use-after-free vulnerability in the Linux kernel's net/mlx5e (Mellanox Ethernet) driver, specifically in the TC (Traffic Control) post-action flow attribute handling code. The flaw arises because mlx5e_tc_post_act_add() erroneously creates a second clone of flow post-action attributes that were already cloned in mlx5e_clone_flow_attr_for_post_act(), resulting in a copy that is not properly updated during neighbor (neigh) update operations, leading to a use-after-free condition. The vulnerability was published on December 30, 2025, and affects the Linux kernel. It carries an EPSS score of approximately 0.018% (very low), and no CVSS score has been publicly assigned at this time (CVE Record, Vulners).

The root cause is a use-after-free (CWE-416) in the Linux kernel's net/mlx5e TC offload subsystem. When mlx5e_tc_post_act_add() creates a redundant second copy of flow post-action attributes (already cloned by mlx5e_clone_flow_attr_for_post_act()), the second copy is not updated during neighbor table update events. This leaves a stale pointer that is subsequently accessed, triggering a KASAN-detected use-after-free in mlx5_cmd_set_fte(). The fix assigns handle->attribute directly to the post_attr provided by the caller rather than allocating a new copy. The vulnerability is local in nature, requiring the ability to configure TC flow rules on a system with an mlx5e-based Mellanox NIC (CVE Record, Infinitsec).

Successful exploitation of this use-after-free vulnerability can lead to kernel memory corruption, potentially causing a system crash (denial of service) or, in more severe scenarios, privilege escalation or arbitrary code execution in kernel context. The affected component is the mlx5e network driver used with Mellanox/NVIDIA ConnectX NICs, so systems using these adapters with TC offload rules are at risk. The primary impact is availability (kernel panic/crash), though memory corruption bugs of this class can sometimes be leveraged for privilege escalation by a local attacker (CVE Record, Infinitsec).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2023-54262. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. Exploitation requires local access and the presence of Mellanox mlx5e hardware with TC offload configured, significantly limiting the attack surface (Feedly, Tenable).

• Logs: Kernel logs containing BUG: KASAN: use-after-free in mlx5_cmd_set_fte or related KASAN stack traces involving mlx5_core module.
• Logs: Kernel oops or panic messages referencing mlx5e_tc_post_act_add or mlx5e_clone_flow_attr_for_post_act in the call stack.
• Process/System: Unexpected system crashes or kernel panics on hosts equipped with Mellanox/NVIDIA ConnectX NICs running TC offload rules.

The Linux kernel maintainers have addressed this vulnerability through patches applied to stable kernel branches. The fix modifies mlx5e_tc_post_act_add() to assign handle->attribute directly to the caller-provided post_attr instead of creating a redundant clone. Users should update to a patched Linux kernel version that includes the relevant commits (e.g., 2d57a514f9ab, 8fd1dac646e6, c382b693ffcb, e9fce818fe00 in the stable tree). As a workaround, disabling TC hardware offload on mlx5e interfaces (ethtool -K <iface> hw-tc-offload off) can mitigate the risk until a patched kernel is applied (Kernel Git, Tenable).