CVE-2023-54291: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54291 is a NULL pointer dereference vulnerability in the Linux kernel's VDUSE (vDPA Device in Userspace) subsystem. The flaw exists in the vduse_vdpa_set_vq_affinity callback, which can be invoked with a NULL cpu_mask value when a VDUSE device is being deleted, leading to a kernel NULL pointer dereference. The vulnerability was published on December 30, 2025, and affects the Linux kernel (specific stable branches). Feedly estimates its severity as Medium, with an EPSS score of 0.00018 (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the VDUSE kernel subsystem. When a VDUSE device is deleted, the vduse_vdpa_set_vq_affinity callback is called with a NULL cpu_mask pointer. The code then attempts to dereference this NULL pointer (e.g., via memcpy_orig), triggering a kernel oops. The fix resets the virtqueue's IRQ affinity mask to include all CPUs instead of attempting to copy from the NULL pointer. The crash trace shows the fault occurring at memcpy_orig+0xc5/0x130 with RSI register set to 0x0 (NULL source address) (Feedly).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic (oops) and system crash, impacting availability. The vulnerability is locally exploitable and primarily affects systems using the VDUSE subsystem (virtual device userspace framework). There is no evidence of confidentiality or integrity impact beyond the denial-of-service caused by the kernel crash (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2023-54291. The EPSS score is very low at 0.00018, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a system with the VDUSE subsystem active and the ability to create and delete VDUSE devices (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in the stable kernel trees. The fix modifies vduse_vdpa_set_vq_affinity to check for a NULL cpu_mask and, when NULL is detected, resets the virtqueue's IRQ affinity to all CPUs rather than dereferencing the NULL pointer. Users should apply the relevant stable kernel patches referenced at the kernel.org stable repository (commits f06cf1e1a503169280467d12d2ec89bf2c30ace7 and f9d46429de2a251e1e4962e1bf86c344d6336562). Linux distribution users should update to the latest patched kernel version provided by their vendor (Feedly).