CVE-2023-54274 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Add a check for valid 'mad_agent' pointer
When unregistering MAD agent, srpt module has a non-null check for 'mad_agent' pointer before invoking ib_unregister_mad_agent(). This check can pass if 'mad_agent' variable holds an error value. The 'mad_agent' can have an error value for a short window when srpt_add_one() and srpt_remove_one() is executed simultaneously.
In srpt module, added a valid pointer check for 'sport->mad_agent' before unregistering MAD agent.
This issue can hit when RoCE driver unregisters ib_device
Stack Trace: ------------ BUG: kernel NULL pointer dereference, address: 000000000000004d PGD 145003067 P4D 145003067 PUD 2324fe067 PMD 0 Oops: 0002 [#1] PREEMPT SMP NOPTI
CPU: 10 PID: 4459 Comm: kworker/u80:0 Kdump: loaded Tainted: P Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.5.4 01/13/2020 Workqueue: bnxt_re bnxt_re_task [bnxt_re]
RIP: 0010:_raw_spin_lock_irqsave+0x19/0x40 Call Trace: ib_unregister_mad_agent+0x46/0x2f0 [ib_core]
IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready ? __schedule+0x20b/0x560 srpt_unregister_mad_agent+0x93/0xd0 [ib_srpt]
srpt_remove_one+0x20/0x150 [ib_srpt]
remove_client_context+0x88/0xd0 [ib_core]
bond0: (slave p2p1): link status definitely up, 100000 Mbps full duplex disable_device+0x8a/0x160 [ib_core]
bond0: active interface up! ? kernfs_name_hash+0x12/0x80 (NULL device *): Bonding Info Received: rdev: 000000006c0b8247 __ib_unregister_device+0x42/0xb0 [ib_core]
(NULL device *): Master: mode: 4 num_slaves:2 ib_unregister_device+0x22/0x30 [ib_core]
(NULL device *): Slave: id: 105069936 name:p2p1 link:0 state:0 bnxt_re_stopqps_and_ib_uninit+0x83/0x90 [bnxt_re]
bnxt_re_alloc_lag+0x12e/0x4e0 [bnxt_re]
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability CVE-2023-54274 affects the Linux kernel's RDMA subsystem, specifically within the srpt (SCSI RDMA Protocol) module. This issue represents a null pointer dereference that occurs during the unregistering of MAD (Management Datagram) agents in RDMA environments. The flaw manifests when the srpt module attempts to unregister a MAD agent without properly validating the pointer's legitimacy, leading to potential system crashes and instability. The vulnerability is particularly concerning as it can be triggered during RoCE (RDMA over Converged Ethernet) driver unregistration processes, which are common operations in high-performance computing environments.
The technical root cause stems from a race condition occurring between the srpt_add_one() and srpt_remove_one() functions during device registration and unregistration cycles. During these concurrent operations, the mad_agent variable can hold an error value that passes the initial null check but subsequently causes a kernel panic when ib_unregister_mad_agent() is invoked. This condition creates a window where the mad_agent pointer contains an invalid reference, specifically the value 0x4d as indicated in the stack trace, which when dereferenced leads to the kernel NULL pointer dereference. The vulnerability is classified under CWE-476 as a NULL pointer dereference, and it aligns with ATT&CK technique T1490 for denial of service through resource exhaustion or corruption.
The operational impact of this vulnerability extends beyond simple system crashes, as it can compromise the stability of RDMA-based storage and networking infrastructures. When triggered during RoCE driver unregistration, the vulnerability can cause complete system hangs or kernel oops events that require manual intervention to recover. The stack trace demonstrates that the issue occurs within the kernel's workqueue processing context, specifically in the srpt_unregister_mad_agent function, indicating that this vulnerability can affect systems under normal operational loads when device removal occurs. The vulnerability particularly affects systems using the bnxt_re driver as shown in the stack trace, where the error propagates through the bonding and device management layers of the RDMA subsystem.
Mitigation strategies for CVE-2023-54274 require immediate kernel updates to patched versions that implement proper pointer validation before MAD agent unregistration. The fix introduced in the patched kernel adds a valid pointer check for sport->mad_agent before proceeding with the unregistering operation, preventing the execution of ib_unregister_mad_agent() with invalid references. Organizations should prioritize patching their RDMA-enabled systems, particularly those running RoCE drivers and the affected bnxt_re driver. Additional monitoring should be implemented to detect unusual device unregistration patterns that might precede exploitation attempts. System administrators should also consider implementing kernel lockdown mechanisms and ensuring that only trusted code can access RDMA device management interfaces. The vulnerability's impact on high-availability systems makes it critical to implement these mitigations promptly, as any exploitation could result in significant service disruption and potential data loss in enterprise environments relying on RDMA infrastructure.