CVE-2023-53110: net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-02 · updated 2026-10-15
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() When performing a stress test on SMC-R by rmmod mlx5_ib driver during the wrk/nginx test, we found that there is a probability of triggering a panic while terminating all link groups. This issue dues to the race between smc_smcr_terminate_all() and smc_buf_create(). smc_smcr_terminate_all smc_buf_create /* init */ conn->sndbuf_desc = NULL; ... __smc_lgr_terminate smc_conn_kill smc_close_abort smc_cdc_get_slot_and_msg_send __softirqentry_text_start smc_wr_tx_process_cqe smc_cdc_tx_handler READ(conn->sndbuf_desc->len); /* panic dues to NULL sndbuf_desc */ conn->sndbuf_desc = xxx; This patch tries to fix the issue by always to check the sndbuf_desc before send any cdc msg, to make sure that no null pointer is seen during cqe processing.

Affected products

Linux kernel: from 5.5 before 5.10.176; from 5.11 before 5.15.104; from 5.16 before 6.1.21; from 6.2 before 6.2.8; 6.3-rc1, 6.3-rc2 — fixed in 5.10.176, 5.15.104, 6.1.21, 6.2.8

How to fix

Upgrade to a fixed version: Linux kernel 5.10.176, 5.15.104, 6.1.21, 6.2.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53110 or the next vulnerability affects your stack