LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54238: mlx5: fix skb leak while fifo resync and push

In the Linux kernel, the following vulnerability has been resolved: mlx5: fix skb leak while fifo resync and push During ptp resync operation SKBs were poped from the fifo but were never freed neither by napi_consume nor by dev_kfree_skb_any. Add call to napi_consume_skb to properly free SKBs. Another leak was happening because mlx5e_skb_fifo_has_room() had an error in the check. Comparing free running counters works well unless C promotes the types to something wider than the counter. In this case counters are u16 but the result of the substraction is promouted to int and it causes wrong result (negative value) of the check when producer have already overlapped but consumer haven't yet. Explicit cast to u16 fixes the issue.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a memory leak in the mlx5 networking path during PTP resync and FIFO handling. Packet buffers can be removed from a queue without being freed. Business risk is mainly availability: affected hosts may lose memory over time if the vulnerable path is exercised.

Executive priority

Treat as a patch-management issue for Linux infrastructure with mlx5 networking. Without CVSS, KEV, or exploit evidence, it should not outrank actively exploited vulnerabilities, but it matters for availability-sensitive systems.

Technical view

The fix adds napi_consume_skb for SKBs popped during PTP resync and corrects mlx5e_skb_fifo_has_room by casting a counter subtraction to u16. The source describes u16 producer/consumer counters being promoted to int, causing incorrect room checks after wraparound.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the mlx5 code path present and relevant networking or PTP behavior in use. The bundle lists affected Linux kernel versions but does not provide distribution package mappings.

Exploitation context

The bundle does not cite active exploitation, a public exploit, or CISA KEV listing. The described impact is a kernel memory leak, so practical risk depends on whether an attacker or workload can repeatedly trigger the affected mlx5 path.

Researcher notes

Evidence is specific to a Linux mlx5 skb leak fix, but the bundle lacks CVSS, CWE, affected distribution packages, and exploitability analysis. Validate exposure by kernel build lineage and driver usage rather than the CVE title alone.

Mitigation direction

  • Upgrade to a vendor kernel containing the referenced stable fixes.
  • Review Linux distribution advisories for CVE-2023-54238 package status.
  • Prioritize hosts using mlx5 networking or PTP features.
  • If patch timing is unclear, request vendor guidance before relying on compensating controls.

Validation and detection

  • Inventory Linux kernel versions across systems using mlx5 networking.
  • Confirm whether the referenced stable commits are included in deployed kernels.
  • Check vendor security trackers for fixed package versions.
  • Monitor affected hosts for abnormal kernel memory growth or networking instability.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54238 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux58a518948f60153e8f6cb8361d2712aa3a1af94a, 58a518948f60153e8f6cb8361d2712aa3a1af94a, 58a518948f60153e8f6cb8361d2712aa3a1af94aunaffected
LinuxLinux6.0, 0, 6.1.18, 6.2.5, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.