Security readout for executives and security teams
Plain-English summary
This is a Linux kernel driver bug in mlx5e networking offload cleanup. In a specific ECMP IP tunnel offload scenario, driver unload or eswitch unpair can touch freed neighbor data, causing kernel memory safety failure and likely service disruption.
Executive priority
Treat as targeted operational risk for specialized high-performance networking hosts. Prioritize affected fleet segments first; routine enterprise servers without this offload path likely have lower urgency, but should follow normal kernel patch cycles.
Technical view
The issue is a use-after-free in mlx5e representor neighbor cleanup. When ECMP tunnel encapsulation offload duplicates flows to a peer eswitch, cleanup ordering can free peer uplink representor neighbor state before peer flow deletion later accesses it.
Likely exposure
Exposure appears limited to Linux systems using mlx5e/mlx5_core eswitch representors with IP tunnel encapsulation offloaded in ECMP mode. General Linux hosts without this driver/offload configuration are less likely to be exposed based on the supplied sources.
Exploitation context
The bundle shows a KASAN use-after-free during driver unload/unpair, but does not cite public exploitation, KEV listing, exploit availability, CVSS, or attacker prerequisites. Active exploitation should not be assumed.
Researcher notes
Evidence supports a cleanup-order memory safety bug fixed by moving representor neighbor cleanup into cleanup_tx after uplink TX cleanup. The source bundle does not provide CVSS, CWE, exploitability analysis, or complete affected version-range semantics.
Mitigation direction
- Check vendor or distribution kernel advisories for backported fixes.
- Prioritize kernel updates on hosts using mlx5e eswitch offload features.
- Review the referenced stable commits for fixed cleanup ordering.
- Consider disabling affected offload usage only if vendor guidance supports it.
Validation and detection
- Inventory Linux kernels and mlx5e/mlx5_core driver usage.
- Identify hosts using eswitch representors and ECMP tunnel encapsulation offload.
- Compare deployed kernels with vendor fixed builds or referenced stable commits.
- Review kernel logs for mlx5e_rep_neigh_entry_release or KASAN use-after-free traces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-54148 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d628ba98eb1637acce44001e04c718d8dbb1f7ceCVE reference, Linux
- https://git.kernel.org/stable/c/36697c592cd0809e626df01b3644c23ac522a4d0CVE reference, Linux
- https://git.kernel.org/stable/c/d03b6e6f31820b84f7449cca022047f36c42bc3fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.