LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54237: net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() There is a certain chance to trigger the following panic: PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:48" #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7 #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60 #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7 #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715 #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654 #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62 [exception RIP: ib_alloc_mr+19] RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004 RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000010 R14: ffff88c1ab040a50 R15: ffff88c1ea281d00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc] #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc] #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc] The reason here is that when the server tries to create a second link, smc_llc_srv_add_link() has no protection and may add a new link to link group. This breaks the security environment protected by llc_conf_mutex.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can lead to a kernel panic when SMC networking code handles adding a second server link without proper mutex protection. Business impact is primarily availability: affected systems could crash under the vulnerable condition. The supplied sources do not confirm remote exploitability, active exploitation, or a severity score.

Executive priority

Treat this as a targeted availability risk, not a confirmed emergency. Prioritize verification on Linux servers where kernel crashes would disrupt critical services, then patch through normal kernel maintenance unless vendor guidance raises urgency.

Technical view

The bug is in net/smc. smc_llc_srv_add_link() could add a link to a link group without protection from llc_conf_mutex, disrupting assumptions around the SMC link-group security environment. The observed failure path reaches ib_alloc_mr through SMC buffer and RDMA memory-region setup, ending in a page-fault panic.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with SMC functionality relevant to the vulnerable path. The bundle lists affected Linux versions including 5.8, 6.1.16, 6.2.3, and 6.3, but does not provide distribution-specific package names or configurations.

Exploitation context

The source describes a probabilistic panic condition, not a public exploit. CISA KEV status is false in the bundle. No cited source confirms active exploitation, exploit code, privilege requirements, network reachability, or attacker-controlled trigger conditions.

Researcher notes

Evidence supports a kernel concurrency or locking flaw around SMC link addition. The bundle lacks CVSS, CWE, attack vector, exploitability, and distro mapping. Analysis should stay close to kernel commit behavior and avoid assuming broad remote denial-of-service impact without more evidence.

Mitigation direction

  • Apply the relevant Linux stable kernel fix through vendor-supported kernel updates.
  • Check distribution advisories for exact fixed package versions and backport status.
  • Prioritize systems using SMC, RDMA, or related kernel modules.
  • If immediate patching is unavailable, review vendor guidance for safe configuration mitigations.

Validation and detection

  • Inventory Linux kernel versions across affected server fleets.
  • Identify hosts with SMC functionality or related modules enabled.
  • Confirm whether vendor kernel packages include one of the referenced stable fixes.
  • Review crash logs for SMC-related panic traces matching the described call path.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54237 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2d2209f2018943d4152a21eff5b76f1952e0b435, 2d2209f2018943d4152a21eff5b76f1952e0b435, 2d2209f2018943d4152a21eff5b76f1952e0b435unaffected
LinuxLinux5.8, 0, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.