LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53463: ibmvnic: Do not reset dql stats on NON_FATAL err

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Do not reset dql stats on NON_FATAL err All ibmvnic resets, make a call to netdev_tx_reset_queue() when re-opening the device. netdev_tx_reset_queue() resets the num_queued and num_completed byte counters. These stats are used in Byte Queue Limit (BQL) algorithms. The difference between these two stats tracks the number of bytes currently sitting on the physical NIC. ibmvnic increases the number of queued bytes though calls to netdev_tx_sent_queue() in the drivers xmit function. When, VIOS reports that it is done transmitting bytes, the ibmvnic device increases the number of completed bytes through calls to netdev_tx_completed_queue(). It is important to note that the driver batches its transmit calls and num_queued is increased every time that an skb is added to the next batch, not necessarily when the batch is sent to VIOS for transmission. Unlike other reset types, a NON FATAL reset will not flush the sub crq tx buffers. Therefore, it is possible for the batched skb array to be partially full. So if there is call to netdev_tx_reset_queue() when re-opening the device, the value of num_queued (0) would not account for the skb's that are currently batched. Eventually, when the batch is sent to VIOS, the call to netdev_tx_completed_queue() would increase num_completed to a value greater than the num_queued. This causes a BUG_ON crash: ibmvnic 30000002: Firmware reports error, cause: adapter problem. Starting recovery... ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ------------[ cut here ]------------ kernel BUG at lib/dynamic_queue_limits.c:27! Oops: Exception in kernel mode, sig: 5 [....] NIP dql_completed+0x28/0x1c0 LR ibmvnic_complete_tx.isra.0+0x23c/0x420 [ibmvnic] Call Trace: ibmvnic_complete_tx.isra.0+0x3f8/0x420 [ibmvnic] (unreliable) ibmvnic_interrupt_tx+0x40/0x70 [ibmvnic] __handle_irq_event_percpu+0x98/0x270 ---[ end trace ]--- Therefore, do not reset the dql stats when performing a NON_FATAL reset.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A bookkeeping error in Linux’s IBM Virtual NIC driver can crash the operating system during recovery from a non-fatal adapter error. The impact is loss of availability rather than data theft or modification. Exposure is concentrated in Linux systems using the ibmvnic driver, not Linux systems generally.

Executive priority

Treat this as a high-priority availability issue for IBM virtualized Linux infrastructure using ibmvnic. Patch critical or single-instance services promptly. Broader emergency action is not supported because no active exploitation is cited and unaffected systems outside this driver path have low likely exposure.

Technical view

During a NON_FATAL ibmvnic reset, transmit buffers remain populated, but queue-limit counters were reset. Later completions can exceed the recorded queued bytes, triggering a kernel BUG in dynamic_queue_limits.c. The correction preserves these counters for NON_FATAL resets. The supplied CVSS 3.1 score is 7.5, reflecting high availability impact.

Likely exposure

Exposure is limited to systems using ibmvnic. Hosts without this driver and device path are unlikely affected. The supplied version data ambiguously lists 5.11, 5.15.121, 6.1.39, 6.4.4, and 6.5; confirm exact affected and corrected releases with the Linux distributor.

Exploitation context

The source bundle does not identify active exploitation, and the CVE is not listed as KEV. Although the supplied vector states network reachability, the technical description only documents a crash following a VIOS-reported adapter problem. It does not establish a practical remote attack method.

Researcher notes

The failure is a queue-accounting invariant violation: NON_FATAL recovery preserves partially filled transmit batches while zeroing queued and completed counters. Subsequent completions can make completed bytes exceed queued bytes and hit BUG_ON. The sources provide no exploit proof, attacker-controlled trigger analysis, CWE assignment, or clear downstream version ranges.

Mitigation direction

  • Update to a vendor-supported kernel release containing the applicable stable fix.
  • Consult the Linux distributor for exact package status because the supplied version mapping is ambiguous.
  • Prioritize ibmvnic systems supporting critical workloads or lacking high-availability failover.
  • Use workload failover or redundancy until affected production kernels can be updated.

Validation and detection

  • Inventory systems that load or use the ibmvnic driver.
  • Record each system’s running kernel and distributor package version.
  • Verify the installed kernel includes the applicable referenced stable commit.
  • Review kernel logs for ibmvnic recovery, dql_completed, dynamic_queue_limits, BUG, or kernel Oops events.
  • Test NON_FATAL recovery only in a controlled non-production environment after remediation.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53463 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2023-53463Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0d973388185d49add56b81ca82fa5e4348019df8, 0d973388185d49add56b81ca82fa5e4348019df8, 0d973388185d49add56b81ca82fa5e4348019df8, 0d973388185d49add56b81ca82fa5e4348019df8unaffected
LinuxLinux5.11, 0, 5.15.121, 6.1.39, 6.4.4, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.