LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54126: crypto: safexcel - Cleanup ring IRQ workqueues on load failure

In the Linux kernel, the following vulnerability has been resolved: crypto: safexcel - Cleanup ring IRQ workqueues on load failure A failure loading the safexcel driver results in the following warning on boot, because the IRQ affinity has not been correctly cleaned up. Ensure we clean up the affinity and workqueues on a failure to load the driver. crypto-safexcel: probe of f2800000.crypto failed with error -2 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 232 at kernel/irq/manage.c:1913 free_irq+0x300/0x340 Modules linked in: hwmon mdio_i2c crypto_safexcel(+) md5 sha256_generic libsha256 authenc libdes omap_rng rng_core nft_masq nft_nat nft_chain_nat nf_nat nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables libcrc32c nfnetlink fuse autofs4 CPU: 1 PID: 232 Comm: systemd-udevd Tainted: G W 6.1.6-00002-g9d4898824677 #3 Hardware name: MikroTik RB5009 (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : free_irq+0x300/0x340 lr : free_irq+0x2e0/0x340 sp : ffff800008fa3890 x29: ffff800008fa3890 x28: 0000000000000000 x27: 0000000000000000 x26: ffff8000008e6dc0 x25: ffff000009034cac x24: ffff000009034d50 x23: 0000000000000000 x22: 000000000000004a x21: ffff0000093e0d80 x20: ffff000009034c00 x19: ffff00000615fc00 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 000075f5c1584c5e x14: 0000000000000017 x13: 0000000000000000 x12: 0000000000000040 x11: ffff000000579b60 x10: ffff000000579b62 x9 : ffff800008bbe370 x8 : ffff000000579dd0 x7 : 0000000000000000 x6 : ffff000000579e18 x5 : ffff000000579da8 x4 : ffff800008ca0000 x3 : ffff800008ca0188 x2 : 0000000013033204 x1 : ffff000009034c00 x0 : ffff8000087eadf0 Call trace: free_irq+0x300/0x340 devm_irq_release+0x14/0x20 devres_release_all+0xa0/0x100 device_unbind_cleanup+0x14/0x60 really_probe+0x198/0x2d4 __driver_probe_device+0x74/0xdc driver_probe_device+0x3c/0x110 __driver_attach+0x8c/0x190 bus_for_each_dev+0x6c/0xc0 driver_attach+0x20/0x30 bus_add_driver+0x148/0x1fc driver_register+0x74/0x120 __platform_driver_register+0x24/0x30 safexcel_init+0x48/0x1000 [crypto_safexcel] do_one_initcall+0x4c/0x1b0 do_init_module+0x44/0x1cc load_module+0x1724/0x1be4 __do_sys_finit_module+0xbc/0x110 __arm64_sys_finit_module+0x1c/0x24 invoke_syscall+0x44/0x110 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x20/0x80 el0_svc+0x14/0x4c el0t_64_sync_handler+0xb0/0xb4 el0t_64_sync+0x148/0x14c ---[ end trace 0000000000000000 ]---

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the Safexcel crypto driver. If the driver fails to load, it may not clean up IRQ affinity and workqueues correctly, causing a kernel warning during boot or module loading. Public sources do not show active exploitation or a clear confidentiality, integrity, or availability impact.

Executive priority

Handle through normal kernel maintenance unless affected hardware is deployed at scale or boot stability is business-critical. There is no public evidence of active exploitation in the provided sources, but affected kernels should still receive vendor-supported updates.

Technical view

The flaw is in crypto_safexcel probe failure cleanup. On load failure, IRQ affinity and ring IRQ workqueues were not properly released before devres cleanup, leading to a free_irq warning. The kernel stable fixes add cleanup handling. No CVSS, CWE, or exploitability details are provided in the supplied sources.

Likely exposure

Exposure appears limited to Linux systems with the crypto_safexcel driver and compatible hardware. The CVE record lists Linux affected versions including 4.13, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4.

Exploitation context

The source bundle reports no CISA KEV listing and provides no cited evidence of exploitation. The described behavior is a kernel warning during failed driver load, not a demonstrated attack path. Treat exploitability as unproven from available public evidence.

Researcher notes

The record lacks CVSS, CWE, and a defined security impact beyond warning-producing cleanup failure. The affected version data is terse and should be cross-checked against distribution advisories. Focus validation on driver presence, hardware applicability, and whether the stable cleanup commits are included.

Mitigation direction

  • Apply a Linux kernel update containing the referenced stable safexcel cleanup fixes.
  • Prioritize systems that load crypto_safexcel or use Safexcel-compatible crypto hardware.
  • If using vendor kernels, follow the vendor advisory or backport guidance.
  • Monitor kernel logs after update for recurring crypto_safexcel probe warnings.

Validation and detection

  • Inventory Linux kernels against the affected versions listed in the CVE record.
  • Check whether the crypto_safexcel driver is present or loaded on target systems.
  • Review boot logs for crypto-safexcel probe failures and free_irq warnings.
  • Confirm the running kernel includes one of the referenced stable commits or vendor equivalent.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54126 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1b44c5a60c137e5fd0c2c8b86e58fdbc9cd181ce, 1b44c5a60c137e5fd0c2c8b86e58fdbc9cd181ce, 1b44c5a60c137e5fd0c2c8b86e58fdbc9cd181ce, 1b44c5a60c137e5fd0c2c8b86e58fdbc9cd181ce, 1b44c5a60c137e5fd0c2c8b86e58fdbc9cd181ce, 1b44c5a60c137e5fd0c2c8b86e58fdbc9cd181ce, 1b44c5a60c137e5fd0c2c8b86e58fdbc9cd181ceunaffected
LinuxLinux4.13, 0, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.