CVE-2023-54003 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix GID entry ref leak when create_ah fails
If AH create request fails, release sgid_attr to avoid GID entry referrence leak reported while releasing GID table
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 01/30/2026
The vulnerability identified as CVE-2023-54003 affects the Linux kernel's RDMA/core subsystem and represents a memory management issue that can lead to resource exhaustion. This flaw specifically manifests within the address handle (AH) creation process where proper cleanup procedures are not adequately executed when AH creation fails. The vulnerability occurs in the context of InfiniBand and RDMA (Remote Direct Memory Access) networking operations, which are critical components in high-performance computing environments and data center infrastructures where low-latency network communication is essential.
The technical flaw stems from a reference counting error in the GID (Global Identifier) table management within the RDMA core driver. When the create_ah function encounters a failure during address handle creation, the system fails to properly release the sgid_attr reference, which maintains a reference to the GID entry. This creates a situation where GID table entries remain in use even after they should have been released, leading to a reference leak that accumulates over time. The issue is classified under CWE-404 as an improper resource release or cleanup, specifically involving reference counting mechanisms in kernel memory management. The flaw demonstrates poor error handling in kernel-space code where failure paths do not properly execute cleanup routines that would normally occur during successful operation sequences.
The operational impact of this vulnerability is significant in environments where RDMA operations are frequently performed or where systems handle a large number of concurrent connections. The reference leak can gradually consume available memory resources within the kernel's GID table management system, potentially leading to system instability, performance degradation, or even system crashes under sustained load conditions. This vulnerability particularly affects systems running Linux kernels with RDMA capabilities, including high-performance computing clusters, cloud infrastructure deployments, and enterprise networking environments that rely on InfiniBand or RoCE (RDMA over Converged Ethernet) technologies. The issue can be exploited by malicious actors who might attempt to exhaust system resources through repeated AH creation failures, making it a potential denial-of-service vector that aligns with ATT&CK technique T1499.004 for network denial of service attacks.
Mitigation strategies for CVE-2023-54003 involve applying the official kernel patch that ensures proper release of GID table entries when AH creation fails. System administrators should prioritize updating to affected kernel versions that contain the fix, typically found in kernel releases 6.4 and later. Additionally, monitoring systems for unusual memory consumption patterns in RDMA-related processes can help detect potential exploitation attempts. The fix implements proper error handling that ensures all references are released regardless of the outcome of AH creation operations, preventing the accumulation of stale references in the GID table. Organizations using RDMA technologies should also consider implementing resource limits and monitoring for kernel memory usage to detect anomalous behavior that might indicate exploitation attempts. The vulnerability highlights the importance of thorough error path testing in kernel modules and proper reference counting mechanisms that are essential for maintaining system stability in high-performance networking environments.