CVE-2023-54310: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54310 is a use-after-free vulnerability in the Linux kernel's SCSI mptlan driver, specifically in the mptlan_remove() function, caused by a race condition during driver unload. When the driver is unloaded, free_netdev() frees the network device structure while a concurrent workqueue (mpt_lan_post_receive_buckets_work) may still be accessing it (e.g., reading dev->mtu), resulting in a use-after-free condition. The vulnerability affects the Linux kernel from its earliest versions up to the patched stable releases. It was published on December 30, 2025, with an EPSS score of approximately 0.024% (very low), and no CVSS base score has been formally assigned (Feedly, EUVD).

The root cause is a time-of-check/time-of-use race condition (CWE-416: Use After Free) in the mptlan SCSI LAN driver. During mptlan_probe(), the &priv->post_buckets_task workqueue is initialized and can be started via mpt_lan_wake_post_buckets_task(). When mptlan_remove() is called during driver unload, it invokes free_netdev() which calls kfree(dev), but a concurrent CPU may still be executing mpt_lan_post_receive_buckets_work() and accessing the now-freed dev->mtu field. The fix ensures the workqueue is flushed/cancelled before the cleanup proceeds in mptlan_remove(). Patches were applied across multiple stable kernel branches (Feedly, EUVD).

Successful exploitation of this race condition can lead to kernel memory corruption due to the use-after-free access, potentially causing a kernel panic (denial of service) or, in more severe scenarios, enabling privilege escalation or arbitrary code execution in kernel context. The vulnerability is local in nature, requiring the ability to load/unload the mptlan kernel module, which limits its exploitability to users with sufficient privileges on systems using legacy LSI/MPT Fusion SCSI LAN hardware. The availability impact is the most likely consequence, with integrity and confidentiality impacts being theoretically possible but less probable in practice (Feedly).

The Linux kernel maintainers have released fixes across multiple stable branches. Patched versions include: 4.14.316, 4.19.284, 5.4.244, 5.10.181, 5.15.113, 6.1.30, 6.3.4, and 6.4. Users should update to the appropriate patched stable kernel version for their distribution. As a secondary mitigation, systems that do not use MPT Fusion LAN hardware can blacklist or remove the mptlan kernel module. Notably, the kernel maintainer commented that the mptlan driver should ideally be removed entirely rather than patched (Feedly, EUVD).

The kernel maintainer (mkp) noted in the patch commit message that the mptlan driver should be removed rather than patched, reflecting the legacy and unmaintained status of the affected driver. No significant broader industry or social media reactions have been identified for this vulnerability (Feedly).