CVE-2023-54274: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54274 is a NULL pointer dereference vulnerability in the Linux kernel's RDMA/srpt (SCSI RDMA Protocol target) subsystem. The flaw exists in the MAD (Management Datagram) agent handling within the ib_srpt module, where a non-null check for the mad_agent pointer can pass even when the pointer holds an error value rather than a valid address. This race condition can occur when srpt_add_one() and srpt_remove_one() execute simultaneously, leading to a kernel NULL pointer dereference. The vulnerability was published on December 30, 2025, and has an estimated CVSS severity of Medium (Feedly, CIRCL).

The root cause is a missing valid pointer check (CWE-476: NULL Pointer Dereference) in the srpt_unregister_mad_agent() function of the Linux kernel's ib_srpt module. When srpt_add_one() and srpt_remove_one() are called concurrently — for example, when a RoCE driver unregisters an ib_device — the sport->mad_agent pointer may temporarily hold an error value (e.g., from ERR_PTR()). The existing non-null check does not distinguish between a valid pointer and an error pointer, so ib_unregister_mad_agent() is called with an invalid address, triggering a kernel oops at _raw_spin_lock_irqsave+0x19/0x40. The fix adds an IS_ERR_OR_NULL() check before invoking ib_unregister_mad_agent() (Feedly, CIRCL).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic (oops) and system crash, directly impacting availability. The crash occurs in kernel context (workqueue bnxt_re), meaning no user-space privilege escalation or data exfiltration is directly enabled; however, a system crash can disrupt all services running on the affected host. Systems using RoCE (RDMA over Converged Ethernet) adapters with the ib_srpt module loaded are at risk, particularly in environments with dynamic device registration/deregistration (Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing BUG: kernel NULL pointer dereference, address: 000000000000004d and a call trace referencing ib_unregister_mad_agent, srpt_unregister_mad_agent, and srpt_remove_one.
• Process/Workqueue: Crash attributed to workqueue bnxt_re with task kworker/u80:0 or similar, visible in the oops trace.
• System: Unexpected system reboots or kernel panics on hosts using RoCE adapters (e.g., Broadcom/Emulex bnxt_re driver) with the ib_srpt module loaded, particularly during network interface state changes (e.g., bonding link events).

The Linux kernel maintainers have issued patches across multiple stable branches to add a proper IS_ERR_OR_NULL() check for sport->mad_agent before calling ib_unregister_mad_agent(). Patch commits include 00cc21e32ea1, 5f6ef2a574b0, 8ec6acdb9b6a, 4323aaedeba3, and b713623bfef8 in the stable kernel tree. Users should update to a patched kernel version that includes these fixes. As a workaround, unloading the ib_srpt module when not in use can reduce exposure, though this may not be feasible in production RDMA/storage environments (Feedly, Linux Kernel).