{
  "threat_severity" : "Low",
  "public_date" : "2025-12-30T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: rxrpc: Fix timeout of a call that hasn't yet been granted a channel",
    "id" : "2426218",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2426218"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-366",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nrxrpc: Fix timeout of a call that hasn't yet been granted a channel\nafs_make_call() calls rxrpc_kernel_begin_call() to begin a call (which may\nget stalled in the background waiting for a connection to become\navailable); it then calls rxrpc_kernel_set_max_life() to set the timeouts -\nbut that starts the call timer so the call timer might then expire before\nwe get a connection assigned - leading to the following oops if the call\nstalled:\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n...\nCPU: 1 PID: 5111 Comm: krxrpcio/0 Not tainted 6.3.0-rc7-build3+ #701\nRIP: 0010:rxrpc_alloc_txbuf+0xc0/0x157\n...\nCall Trace:\n<TASK>\nrxrpc_send_ACK+0x50/0x13b\nrxrpc_input_call_event+0x16a/0x67d\nrxrpc_io_thread+0x1b6/0x45f\n? _raw_spin_unlock_irqrestore+0x1f/0x35\n? rxrpc_input_packet+0x519/0x519\nkthread+0xe7/0xef\n? kthread_complete_and_exit+0x1b/0x1b\nret_from_fork+0x22/0x30\nFix this by noting the timeouts in struct rxrpc_call when the call is\ncreated.  The timer will be started when the first packet is transmitted.\nIt shouldn't be possible to trigger this directly from userspace through\nAF_RXRPC as sendmsg() will return EBUSY if the call is in the\nwaiting-for-conn state if it dropped out of the wait due to a signal.", "A NULL pointer dereference flaw was found in the Linux kernel's RxRPC/AFS networking stack. When making an AFS call, the call timer can expire before a connection is assigned if the call gets stalled waiting for a connection. This causes a NULL pointer dereference in rxrpc_alloc_txbuf() when attempting to send an ACK." ],
  "statement" : "This primarily affects AFS filesystem users. Direct exploitation from userspace via AF_RXRPC sockets is prevented as sendmsg() returns EBUSY in the vulnerable state. The issue requires specific timing conditions where connection establishment is delayed while the call timer expires.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-11-07T00:00:00Z",
    "advisory" : "RHSA-2023:6583",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-362.8.1.el9_3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-11-07T00:00:00Z",
    "advisory" : "RHSA-2023:6583",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-362.8.1.el9_3"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-54195\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-54195\nhttps://lore.kernel.org/linux-cve-announce/2025123028-CVE-2023-54195-07d1@gregkh/T" ],
  "name" : "CVE-2023-54195",
  "csaw" : false
}