CVE-2023-54238: mlx5: fix skb leak while fifo resync and push
In the Linux kernel, the following vulnerability has been resolved:
mlx5: fix skb leak while fifo resync and push
During ptp resync operation SKBs were poped from the fifo but were never
freed neither by napi_consume nor by dev_kfree_skb_any. Add call to
napi_consume_skb to properly free SKBs.
Another leak was happening because mlx5e_skb_fifo_has_room() had an error
in the check. Comparing free running counters works well unless C promotes
the types to something wider than the counter. In this case counters are
u16 but the result of the substraction is promouted to int and it causes
wrong result (negative value) of the check when producer have already
overlapped but consumer haven't yet. Explicit cast to u16 fixes the issue.
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue is a memory leak in the mlx5 networking path during PTP resync and FIFO handling. Packet buffers can be removed from a queue without being freed. Business risk is mainly availability: affected hosts may lose memory over time if the vulnerable path is exercised.
Executive priority
Treat as a patch-management issue for Linux infrastructure with mlx5 networking. Without CVSS, KEV, or exploit evidence, it should not outrank actively exploited vulnerabilities, but it matters for availability-sensitive systems.
Technical view
The fix adds napi_consume_skb for SKBs popped during PTP resync and corrects mlx5e_skb_fifo_has_room by casting a counter subtraction to u16. The source describes u16 producer/consumer counters being promoted to int, causing incorrect room checks after wraparound.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with the mlx5 code path present and relevant networking or PTP behavior in use. The bundle lists affected Linux kernel versions but does not provide distribution package mappings.
Exploitation context
The bundle does not cite active exploitation, a public exploit, or CISA KEV listing. The described impact is a kernel memory leak, so practical risk depends on whether an attacker or workload can repeatedly trigger the affected mlx5 path.
Researcher notes
Evidence is specific to a Linux mlx5 skb leak fix, but the bundle lacks CVSS, CWE, affected distribution packages, and exploitability analysis. Validate exposure by kernel build lineage and driver usage rather than the CVE title alone.
Mitigation direction
Upgrade to a vendor kernel containing the referenced stable fixes.
Review Linux distribution advisories for CVE-2023-54238 package status.
Prioritize hosts using mlx5 networking or PTP features.
If patch timing is unclear, request vendor guidance before relying on compensating controls.
Validation and detection
Inventory Linux kernel versions across systems using mlx5 networking.
Confirm whether the referenced stable commits are included in deployed kernels.
Check vendor security trackers for fixed package versions.
Monitor affected hosts for abnormal kernel memory growth or networking instability.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-54238 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
4Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Dec 30, 2025, 12:11 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.