{
  "threat_severity" : "Moderate",
  "public_date" : "2025-12-24T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: net/mlx5e: Move representor neigh cleanup to profile cleanup_tx",
    "id" : "2425103",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2425103"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-416",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nnet/mlx5e: Move representor neigh cleanup to profile cleanup_tx\nFor IP tunnel encapsulation in ECMP (Equal-Cost Multipath) mode, as\nthe flow is duplicated to the peer eswitch, the related neighbour\ninformation on the peer uplink representor is created as well.\nIn the cited commit, eswitch devcom unpair is moved to uplink unload\nAPI, specifically the profile->cleanup_tx. If there is a encap rule\noffloaded in ECMP mode, when one eswitch does unpair (because of\nunloading the driver, for instance), and the peer rule from the peer\neswitch is going to be deleted, the use-after-free error is triggered\nwhile accessing neigh info, as it is already cleaned up in uplink's\nprofile->disable, which is before its profile->cleanup_tx.\nTo fix this issue, move the neigh cleanup to profile's cleanup_tx\ncallback, and after mlx5e_cleanup_uplink_rep_tx is called. The neigh\ninit is moved to init_tx for symmeter.\n[ 2453.376299] BUG: KASAN: slab-use-after-free in mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core]\n[ 2453.379125] Read of size 4 at addr ffff888127af9008 by task modprobe/2496\n[ 2453.381542] CPU: 7 PID: 2496 Comm: modprobe Tainted: G    B              6.4.0-rc7+ #15\n[ 2453.383386] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[ 2453.384335] Call Trace:\n[ 2453.384625]  <TASK>\n[ 2453.384891]  dump_stack_lvl+0x33/0x50\n[ 2453.385285]  print_report+0xc2/0x610\n[ 2453.385667]  ? __virt_addr_valid+0xb1/0x130\n[ 2453.386091]  ? mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core]\n[ 2453.386757]  kasan_report+0xae/0xe0\n[ 2453.387123]  ? mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core]\n[ 2453.387798]  mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core]\n[ 2453.388465]  mlx5e_rep_encap_entry_detach+0xa6/0xe0 [mlx5_core]\n[ 2453.389111]  mlx5e_encap_dealloc+0xa7/0x100 [mlx5_core]\n[ 2453.389706]  mlx5e_tc_tun_encap_dests_unset+0x61/0xb0 [mlx5_core]\n[ 2453.390361]  mlx5_free_flow_attr_actions+0x11e/0x340 [mlx5_core]\n[ 2453.391015]  ? complete_all+0x43/0xd0\n[ 2453.391398]  ? free_flow_post_acts+0x38/0x120 [mlx5_core]\n[ 2453.392004]  mlx5e_tc_del_fdb_flow+0x4ae/0x690 [mlx5_core]\n[ 2453.392618]  mlx5e_tc_del_fdb_peers_flow+0x308/0x370 [mlx5_core]\n[ 2453.393276]  mlx5e_tc_clean_fdb_peer_flows+0xf5/0x140 [mlx5_core]\n[ 2453.393925]  mlx5_esw_offloads_unpair+0x86/0x540 [mlx5_core]\n[ 2453.394546]  ? mlx5_esw_offloads_set_ns_peer.isra.0+0x180/0x180 [mlx5_core]\n[ 2453.395268]  ? down_write+0xaa/0x100\n[ 2453.395652]  mlx5_esw_offloads_devcom_event+0x203/0x530 [mlx5_core]\n[ 2453.396317]  mlx5_devcom_send_event+0xbb/0x190 [mlx5_core]\n[ 2453.396917]  mlx5_esw_offloads_devcom_cleanup+0xb0/0xd0 [mlx5_core]\n[ 2453.397582]  mlx5e_tc_esw_cleanup+0x42/0x120 [mlx5_core]\n[ 2453.398182]  mlx5e_rep_tc_cleanup+0x15/0x30 [mlx5_core]\n[ 2453.398768]  mlx5e_cleanup_rep_tx+0x6c/0x80 [mlx5_core]\n[ 2453.399367]  mlx5e_detach_netdev+0xee/0x120 [mlx5_core]\n[ 2453.399957]  mlx5e_netdev_change_profile+0x84/0x170 [mlx5_core]\n[ 2453.400598]  mlx5e_vport_rep_unload+0xe0/0xf0 [mlx5_core]\n[ 2453.403781]  mlx5_eswitch_unregister_vport_reps+0x15e/0x190 [mlx5_core]\n[ 2453.404479]  ? mlx5_eswitch_register_vport_reps+0x200/0x200 [mlx5_core]\n[ 2453.405170]  ? up_write+0x39/0x60\n[ 2453.405529]  ? kernfs_remove_by_name_ns+0xb7/0xe0\n[ 2453.405985]  auxiliary_bus_remove+0x2e/0x40\n[ 2453.406405]  device_release_driver_internal+0x243/0x2d0\n[ 2453.406900]  ? kobject_put+0x42/0x2d0\n[ 2453.407284]  bus_remove_device+0x128/0x1d0\n[ 2453.407687]  device_del+0x240/0x550\n[ 2453.408053]  ? waiting_for_supplier_show+0xe0/0xe0\n[ 2453.408511]  ? kobject_put+0xfa/0x2d0\n[ 2453.408889]  ? __kmem_cache_free+0x14d/0x280\n[ 2453.409310]  mlx5_rescan_drivers_locked.part.0+0xcd/0x2b0 [mlx5_core]\n[ 2453.409973]  mlx5_unregister_device+0x40/0x50 [mlx5_core]\n[ 2453.410561]  mlx5_uninit_one+0x3d/0x110 [mlx5_core]\n[ 2453.411111]  remove_one+0x89/0x130 [mlx5_core]\n[ 24\n---truncated---", "A flaw was identified in the Linux kernel’s Mellanox mlx5 Ethernet driver (net/mlx5e) related to the cleanup order of neighbour information when handling offloaded IP tunnel encapsulation rules in ECMP (Equal-Cost Multipath) mode. In certain scenarios — such as unloading the eswitch device while an offloaded ECMP rule is still active — the representor neighbour data for the peer uplink may be cleaned up prematurely in the profile->disable callback before the intended profile->cleanup_tx callback. This premature cleanup can result in a use-after-free condition when subsequent code attempts to access the freed neighbour data, potentially leading to kernel faults" ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-05-22T00:00:00Z",
    "advisory" : "RHSA-2024:3138",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-04-30T00:00:00Z",
    "advisory" : "RHSA-2024:2394",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.13.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-04-30T00:00:00Z",
    "advisory" : "RHSA-2024:2394",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.13.1.el9_4"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-54148\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-54148\nhttps://lore.kernel.org/linux-cve-announce/2025122425-CVE-2023-54148-569b@gregkh/T" ],
  "name" : "CVE-2023-54148",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}