{
  "threat_severity" : "Low",
  "public_date" : "2025-12-24T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: ixgbe: Fix panic during XDP_TX with > 64 CPUs",
    "id" : "2425098",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2425098"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-1285",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nixgbe: Fix panic during XDP_TX with > 64 CPUs\nCommit 4fe815850bdc (\"ixgbe: let the xdpdrv work with more than 64 cpus\")\nadds support to allow XDP programs to run on systems with more than\n64 CPUs by locking the XDP TX rings and indexing them using cpu % 64\n(IXGBE_MAX_XDP_QS).\nUpon trying this out patch on a system with more than 64 cores,\nthe kernel paniced with an array-index-out-of-bounds at the return in\nixgbe_determine_xdp_ring in ixgbe.h, which means ixgbe_determine_xdp_q_idx\nwas just returning the cpu instead of cpu % IXGBE_MAX_XDP_QS.  An example\nsplat:\n==========================================================================\nUBSAN: array-index-out-of-bounds in\n/var/lib/dkms/ixgbe/5.18.6+focal-1/build/src/ixgbe.h:1147:26\nindex 65 is out of range for type 'ixgbe_ring *[64]'\n==========================================================================\nBUG: kernel NULL pointer dereference, address: 0000000000000058\n#PF: supervisor read access in kernel mode\n#PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: 0000 [#1] SMP NOPTI\nCPU: 65 PID: 408 Comm: ksoftirqd/65\nTainted: G          IOE     5.15.0-48-generic #54~20.04.1-Ubuntu\nHardware name: Dell Inc. PowerEdge R640/0W23H8, BIOS 2.5.4 01/13/2020\nRIP: 0010:ixgbe_xmit_xdp_ring+0x1b/0x1c0 [ixgbe]\nCode: 3b 52 d4 cf e9 42 f2 ff ff 66 0f 1f 44 00 00 0f 1f 44 00 00 55 b9\n00 00 00 00 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 08 <44> 0f b7\n47 58 0f b7 47 5a 0f b7 57 54 44 0f b7 76 08 66 41 39 c0\nRSP: 0018:ffffbc3fcd88fcb0 EFLAGS: 00010282\nRAX: ffff92a253260980 RBX: ffffbc3fe68b00a0 RCX: 0000000000000000\nRDX: ffff928b5f659000 RSI: ffff928b5f659000 RDI: 0000000000000000\nRBP: ffffbc3fcd88fce0 R08: ffff92b9dfc20580 R09: 0000000000000001\nR10: 3d3d3d3d3d3d3d3d R11: 3d3d3d3d3d3d3d3d R12: 0000000000000000\nR13: ffff928b2f0fa8c0 R14: ffff928b9be20050 R15: 000000000000003c\nFS:  0000000000000000(0000) GS:ffff92b9dfc00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000058 CR3: 000000011dd6a002 CR4: 00000000007706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n<TASK>\nixgbe_poll+0x103e/0x1280 [ixgbe]\n? sched_clock_cpu+0x12/0xe0\n__napi_poll+0x30/0x160\nnet_rx_action+0x11c/0x270\n__do_softirq+0xda/0x2ee\nrun_ksoftirqd+0x2f/0x50\nsmpboot_thread_fn+0xb7/0x150\n? sort_range+0x30/0x30\nkthread+0x127/0x150\n? set_kthread_struct+0x50/0x50\nret_from_fork+0x1f/0x30\n</TASK>\nI think this is how it happens:\nUpon loading the first XDP program on a system with more than 64 CPUs,\nixgbe_xdp_locking_key is incremented in ixgbe_xdp_setup.  However,\nimmediately after this, the rings are reconfigured by ixgbe_setup_tc.\nixgbe_setup_tc calls ixgbe_clear_interrupt_scheme which calls\nixgbe_free_q_vectors which calls ixgbe_free_q_vector in a loop.\nixgbe_free_q_vector decrements ixgbe_xdp_locking_key once per call if\nit is non-zero.  Commenting out the decrement in ixgbe_free_q_vector\nstopped my system from panicing.\nI suspect to make the original patch work, I would need to load an XDP\nprogram and then replace it in order to get ixgbe_xdp_locking_key back\nabove 0 since ixgbe_setup_tc is only called when transitioning between\nXDP and non-XDP ring configurations, while ixgbe_xdp_locking_key is\nincremented every time ixgbe_xdp_setup is called.\nAlso, ixgbe_setup_tc can be called via ethtool --set-channels, so this\nbecomes another path to decrement ixgbe_xdp_locking_key to 0 on systems\nwith more than 64 CPUs.\nSince ixgbe_xdp_locking_key only protects the XDP_TX path and is tied\nto the number of CPUs present, there is no reason to disable it upon\nunloading an XDP program.  To avoid confusion, I have moved enabling\nixgbe_xdp_locking_key into ixgbe_sw_init, which is part of the probe path.", "A flaw was found in the Linux kernel's ixgbe network driver. On systems with more than 64 CPUs, XDP_TX operations can cause a kernel panic due to an array-index-out-of-bounds access. The ixgbe_xdp_locking_key variable can be incorrectly decremented to zero during ring reconfiguration, causing the driver to use raw CPU numbers instead of CPU % 64 for XDP ring indexing, leading to NULL pointer dereference." ],
  "statement" : "This flaw affects high-core-count systems (more than 64 CPUs) using Intel ixgbe network adapters with XDP programs. The panic can be triggered when loading XDP programs or when using ethtool --set-channels to reconfigure the interface. Servers with many cores using ixgbe NICs for XDP packet processing are at risk.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-05-22T00:00:00Z",
    "advisory" : "RHSA-2024:3138",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-04-30T00:00:00Z",
    "advisory" : "RHSA-2024:2394",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.13.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-04-30T00:00:00Z",
    "advisory" : "RHSA-2024:2394",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.13.1.el9_4"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-54090\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-54090\nhttps://lore.kernel.org/linux-cve-announce/2025122406-CVE-2023-54090-2944@gregkh/T" ],
  "name" : "CVE-2023-54090",
  "mitigation" : {
    "value" : "To mitigate this issue, avoid using XDP programs on ixgbe interfaces on systems with more than 64 CPUs, or prevent the ixgbe module from being loaded if not needed. See https://access.redhat.com/solutions/41278 for instructions on blocking modules.",
    "lang" : "en:us"
  },
  "csaw" : false
}