CVE-2023-54276: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54276 is a NULL pointer dereference vulnerability in the Linux kernel's NFSD (NFS server daemon) subsystem, specifically in the handling of per-CPU reply_cache_stats counters. The flaw was introduced by commit f5f9d4a314da ("nfsd: move reply cache initialization into nfsd startup"), which moved reply cache initialization but failed to account for stats counters that can be accessed before nfsd is started. It was published on December 30, 2025, and affects Linux kernel versions starting from 6.3 up to the fixed commits. The CVSS category is estimated as Medium, with an EPSS score of 0.00018 (Feedly, EUVD).

The root cause is a NULL pointer dereference (CWE-476) in the Linux kernel's nfsd subsystem. When commit f5f9d4a314da moved reply cache initialization to nfsd startup time, it neglected to also move the initialization of per-net and per-CPU reply_cache_stats counters, which remain accessible via /proc/fs/nfsd/reply_cache_stats even when nfsd has never been started. An unprivileged user reading this procfs file triggers nfsd_reply_cache_stats_show to call this_cpu_ptr(NULL), causing a kernel oops on non-x86_64 architectures (e.g., aarch64); on x86_64, this_cpu_ptr(NULL) happens to return a pointer to fixed_percpu_data, masking the bug. The fix moves initialization of the per-net+per-CPU reply-cache counters back into nfsd_init_net, while leaving the rest of the reply cache allocations at nfsd startup (Feedly, Kernel Patch).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel oops (system crash) on affected architectures such as aarch64. This is a local denial-of-service vulnerability — an unprivileged user with access to a network namespace where /proc/fs/nfsd is mounted can crash the kernel by simply reading /proc/fs/nfsd/reply_cache_stats when nfsd has not been started. There is no known confidentiality or integrity impact; the primary consequence is availability loss (Feedly).

1. Identify a vulnerable system: Confirm the target runs a Linux kernel version between 6.3 and the patched commits (e.g., before 6.4.4 or 6.5), on a non-x86_64 architecture such as aarch64.
2. Verify preconditions: Confirm that /proc/fs/nfsd is mounted in the accessible network namespace and that nfsd has not been started in that namespace.
3. Trigger the vulnerability: As an unprivileged user, execute cat /proc/fs/nfsd/reply_cache_stats. This causes the kernel to call nfsd_reply_cache_stats_show, which invokes this_cpu_ptr(NULL), resulting in a NULL pointer dereference and kernel oops/crash (Feedly).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing nfsd_reply_cache_stats_show and a NULL pointer dereference.
• Process: Unexpected system instability or crash following unprivileged access to /proc/fs/nfsd/reply_cache_stats on non-x86_64 systems.
• File System: Audit logs showing reads of /proc/fs/nfsd/reply_cache_stats by unprivileged users in namespaces where nfsd is not running.

Apply the upstream kernel patches that move per-net+per-CPU reply_cache_stats counter initialization back into nfsd_init_net. Fixed commits are available for multiple stable branches: 3025d489f9c8 (stable), 8549384d0f65 (stable), 66a178177b2b (stable), 768c408594b5 (stable), and ed9ab7346e90 (stable); kernel 6.4.4 and 6.5 include the fix (Feedly, Kernel Patch). As a workaround, restrict unprivileged user access to /proc/fs/nfsd/reply_cache_stats via filesystem permissions or namespace isolation until the patch can be applied.