CVE-2023-54323: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54323 is a NULL pointer dereference vulnerability in the Linux kernel's CXL (Compute Express Link) persistent memory (pmem) subsystem, specifically in the cxl/pmem module's nvdimm device registration logic. The flaw was published on December 30, 2025, and affects Linux kernel versions starting from 5.14 up to (but not including) the patched commits in the 6.1.x and 6.2.x stable series. Fixed versions include kernel 6.1.16, 6.2.3, and 6.3. It carries an estimated CVSS severity of Medium and an EPSS score of approximately 0.017% (Feedly, ENISA EUVD).

The root cause is a race condition (CWE-362) between asynchronous nvdimm device registration and CXL module teardown. When the cxl_pci module is rapidly loaded and unloaded in a loop (while true; do modprobe cxl_pci; modprobe -r cxl_pci; done), the bottom half of the async nvdimm registration (via nd_async_device_register) can execute after the CXL subsystem has already freed the context required by cxl_pmem_ctl(). This results in a NULL pointer dereference at address 0x0000000000000040 inside cxl_internal_send_cmd, crashing the kernel. The fix introduces a synchronous registration path for CXL nvdimm devices, since unlike ACPI NFIT, CXL is already marked PROBE_PREFER_ASYNCHRONOUS and does not benefit from parallel registration (Feedly, kernel.org patch).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic (BUG) and system crash, directly impacting availability. The vulnerability is locally triggerable by a user with privileges to load and unload kernel modules, and does not directly expose confidential data or allow code execution in a traditional sense. Systems using CXL-attached persistent memory (NVDIMM) devices are at risk of denial of service through kernel crashes during module cycling (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-54323. The vulnerability requires local access and the ability to load/unload kernel modules, significantly limiting its attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and its EPSS score of approximately 0.017% reflects a very low probability of exploitation (Feedly). Nessus plugin 280780 has been published to detect affected systems (Tenable).

Apply the upstream Linux kernel patches that introduce synchronous nvdimm registration for CXL devices. Fixed versions are available in kernel 6.1.16, 6.2.3, and 6.3 via the following stable commits: a371788d4f4a, 18c65667fa91, and f57aec443c24. As a workaround, restrict unprivileged access to kernel module loading (CAP_SYS_MODULE) to reduce exposure on systems that cannot be immediately patched (Feedly, ENISA EUVD).