LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54326: misc: pci_endpoint_test: Free IRQs before removing the device

In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Free IRQs before removing the device In pci_endpoint_test_remove(), freeing the IRQs after removing the device creates a small race window for IRQs to be received with the test device memory already released, causing the IRQ handler to access invalid memory, resulting in an oops. Free the device IRQs before removing the device to avoid this issue.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash affected systems in a narrow device-removal race involving the PCI endpoint test driver. The documented impact is a kernel oops caused by an interrupt handler touching freed memory. Sources do not provide CVSS, active exploitation, or broader business impact evidence.

Executive priority

Treat as maintenance-priority unless your environment uses PCI endpoint testing or similar lab hardware. There is confirmed crash potential, but the sources do not show active exploitation, CVSS severity, or broad remote exposure.

Technical view

In pci_endpoint_test_remove(), IRQs were freed after device removal. That left a race where an IRQ could arrive after test device memory was released, causing the IRQ handler to access invalid memory and trigger an oops. The upstream fix changes ordering so IRQs are freed before device removal.

Likely exposure

Exposure appears limited to Linux kernels with the pci_endpoint_test driver present and relevant PCI endpoint test functionality in use. The bundle lists affected Linux kernel versions including 4.19, 5.4.251, 5.10.188, 5.15.121, 6.1.40, 6.4.5, and 6.5, but packaging details are not provided.

Exploitation context

CISA KEV is false in the bundle, and no cited source reports active exploitation. The condition is a race during device removal where an interrupt arrives after memory release. Sources support kernel crash risk, not remote code execution or privilege escalation.

Researcher notes

The core issue is lifetime ordering in remove(): device memory was released before IRQ teardown completed. Analysis should focus on driver availability, interrupt delivery during removal, and whether downstream kernels backported the stable commit. Evidence is incomplete on attack prerequisites and reachable privilege boundary.

Mitigation direction

  • Apply vendor or distribution kernel updates that include the referenced stable fixes.
  • Prioritize systems using PCI endpoint testing or loading pci_endpoint_test.
  • If updates are unavailable, check vendor guidance for supported workarounds.
  • Avoid unnecessary loading or use of the pci_endpoint_test driver where operationally feasible.

Validation and detection

  • Inventory Linux kernel versions against the affected versions listed in the CVE bundle.
  • Check whether pci_endpoint_test is built, available, or loaded on relevant systems.
  • Confirm installed kernels include one of the referenced upstream stable commits or downstream backports.
  • Review kernel logs for oops events around PCI endpoint test device removal.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54326 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe03327122e2c8e6ae4565ef5b3d3cbe4364546a1, e03327122e2c8e6ae4565ef5b3d3cbe4364546a1, e03327122e2c8e6ae4565ef5b3d3cbe4364546a1, e03327122e2c8e6ae4565ef5b3d3cbe4364546a1, e03327122e2c8e6ae4565ef5b3d3cbe4364546a1, e03327122e2c8e6ae4565ef5b3d3cbe4364546a1, e03327122e2c8e6ae4565ef5b3d3cbe4364546a1unaffected
LinuxLinux4.19, 0, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.40, 6.4.5, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.