CVE-2023-54306: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54306 is a denial-of-service vulnerability in the Linux kernel's TLS (Transport Layer Security) subsystem, specifically in the net/tls transmit path. The flaw allows a local attacker or an adversarial network receiver to cause kernel tasks to hang indefinitely on the tx_lock mutex by keeping the TCP receive window (RWIN) at zero for extended periods. Affected Linux kernel versions include those from commit 79ffe6087e9145d2377385cac48d0d6a6b4225a5 up to the respective fix commits across stable branches. The vulnerability was disclosed on December 30, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is a locking/concurrency issue (CWE-667: Improper Locking) in the Linux kernel's net/tls layer. When a TLS-enabled socket's transmit thread acquires tx_lock and then blocks waiting for TCP send buffer space (due to a remote peer holding RWIN at 0), it can remain blocked for hours without releasing the lock. Other threads attempting to acquire tx_lock will also hang, leading to a system-wide hung task condition. The fix replaces blocking sleeps with interruptible sleeps and reschedules work items when the lock cannot be immediately acquired, preventing indefinite stalls (Red Hat Advisory, ENISA EUVD).

Successful exploitation results in a high availability impact: kernel threads can hang indefinitely, potentially causing system unresponsiveness or requiring a reboot. There is no confidentiality or integrity impact, as the vulnerability is limited to a denial-of-service condition. The attack is local in scope, meaning an attacker must have local access or control over a network peer communicating via TLS sockets to trigger the condition (Red Hat Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2023-54306. The vulnerability was originally identified via a syzbot (syzkaller) hung task report. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Patches have been backported to multiple stable Linux kernel branches. Fixed versions include 5.4.235, 5.10.173, 5.15.100, 6.1.18, 6.2.5, and 6.3 (mainline). Administrators should update to a patched kernel version for their respective stable branch. The specific fix commits are available in the kernel stable tree (ENISA EUVD, Red Hat Bugzilla). As a temporary workaround, disabling kernel TLS offload (tls module) where not required may reduce exposure.