CVE-2023-54291 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
vduse: fix NULL pointer dereference
vduse_vdpa_set_vq_affinity callback can be called with NULL value as cpu_mask when deleting the vduse device.
This patch resets virtqueue's IRQ affinity mask value to set all CPUs instead of dereferencing NULL cpu_mask.
[ 4760.952149] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 4760.959110] #PF: supervisor read access in kernel mode
[ 4760.964247] #PF: error_code(0x0000) - not-present page
[ 4760.969385] PGD 0 P4D 0
[ 4760.971927] Oops: 0000 [#1] PREEMPT SMP PTI
[ 4760.976112] CPU: 13 PID: 2346 Comm: vdpa Not tainted 6.4.0-rc6+ #4
[ 4760.982291] Hardware name: Dell Inc. PowerEdge R640/0W23H8, BIOS 2.8.1 06/26/2020
[ 4760.989769] RIP: 0010:memcpy_orig+0xc5/0x130
[ 4760.994049] Code: 16 f8 4c 89 07 4c 89 4f 08 4c 89 54 17 f0 4c 89 5c 17 f8 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 fa 08 72 1b <4c> 8b 06 4c 8b 4c 16 f8 4c 89 07 4c 89 4c 17 f8 c3 cc cc cc cc 66
[ 4761.012793] RSP: 0018:ffffb1d565abb830 EFLAGS: 00010246
[ 4761.018020] RAX: ffff9f4bf6b27898 RBX: ffff9f4be23969c0 RCX: ffff9f4bcadf6400
[ 4761.025152] RDX: 0000000000000008 RSI: 0000000000000000 RDI: ffff9f4bf6b27898
[ 4761.032286] RBP: 0000000000000000 R08: 0000000000000008 R09: 0000000000000000
[ 4761.039416] R10: 0000000000000000 R11: 0000000000000600 R12: 0000000000000000
[ 4761.046549] R13: 0000000000000000 R14: 0000000000000080 R15: ffffb1d565abbb10
[ 4761.053680] FS: 00007f64c2ec2740(0000) GS:ffff9f635f980000(0000) knlGS:0000000000000000
[ 4761.061765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4761.067513] CR2: 0000000000000000 CR3: 0000001875270006 CR4: 00000000007706e0
[ 4761.074645] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 4761.081775] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 4761.088909] PKRU: 55555554
[ 4761.091620] Call Trace:
[ 4761.094074] <TASK>
[ 4761.096180] ? __die+0x1f/0x70
[ 4761.099238] ? page_fault_oops+0x171/0x4f0
[ 4761.103340] ? exc_page_fault+0x7b/0x180
[ 4761.107265] ? asm_exc_page_fault+0x22/0x30
[ 4761.111460] ? memcpy_orig+0xc5/0x130
[ 4761.115126] vduse_vdpa_set_vq_affinity+0x3e/0x50 [vduse]
[ 4761.120533] virtnet_clean_affinity.part.0+0x3d/0x90 [virtio_net]
[ 4761.126635] remove_vq_common+0x1a4/0x250 [virtio_net]
[ 4761.131781] virtnet_remove+0x5d/0x70 [virtio_net]
[ 4761.136580] virtio_dev_remove+0x3a/0x90
[ 4761.140509] device_release_driver_internal+0x19b/0x200
[ 4761.145742] bus_remove_device+0xc2/0x130
[ 4761.149755] device_del+0x158/0x3e0
[ 4761.153245] ? kernfs_find_ns+0x35/0xc0
[ 4761.157086] device_unregister+0x13/0x60
[ 4761.161010] unregister_virtio_device+0x11/0x20
[ 4761.165543] device_release_driver_internal+0x19b/0x200
[ 4761.170770] bus_remove_device+0xc2/0x130
[ 4761.174782] device_del+0x158/0x3e0
[ 4761.178276] ? __pfx_vdpa_name_match+0x10/0x10 [vdpa]
[ 4761.183336] device_unregister+0x13/0x60
[ 4761.187260] vdpa_nl_cmd_dev_del_set_doit+0x63/0xe0 [vdpa]
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability identified as CVE-2023-54291 resides within the Linux kernel's virtual device use subsystem, specifically impacting the vduse driver. This flaw manifests as a NULL pointer dereference occurring during the execution of the vduse_vdpa_set_vq_affinity callback function. The issue arises when the cpu_mask parameter is passed as a NULL value while attempting to delete a vduse device, leading to a kernel panic and system instability. The affected kernel version includes 6.4.0-rc6 and later releases, indicating this vulnerability has been present in recent development cycles and potentially affects production systems running these kernel versions.
The technical root cause stems from improper handling of the cpu_mask parameter within the vduse driver's affinity management logic. When a vduse device is being removed, the system attempts to set the virtqueue's IRQ affinity mask to a NULL value, which subsequently triggers a kernel NULL pointer dereference in the memcpy_orig function. This type of error represents a classic instance of improper null checking and memory access validation within kernel space, where the system fails to verify that a pointer parameter contains valid data before attempting to dereference it. The error trace clearly shows the call stack leading to the kernel's page fault handler, indicating that the kernel attempted to read from memory address zero, which is invalid and causes an immediate system crash.
This vulnerability presents a significant operational risk to systems utilizing virtualized network devices through the vduse framework. The NULL pointer dereference can result in complete system crashes, leading to denial of service conditions that may require manual intervention or system reboot to recover. The impact extends beyond simple service disruption as such kernel-level vulnerabilities can potentially be exploited by malicious actors to gain unauthorized access or cause persistent system instability. The vulnerability affects virtualization environments where the vduse driver is actively used for creating virtual devices, particularly those implementing VDPA (Virtual Device Protocol) interfaces for network acceleration. This aligns with CWE-476, which categorizes NULL pointer dereference as a critical weakness in software design, and represents a direct violation of secure coding practices that mandate proper input validation.
The recommended mitigation strategy involves applying the kernel patch that resets the virtqueue's IRQ affinity mask to include all CPUs instead of allowing NULL pointer dereference. This fix ensures that the cpu_mask parameter is properly initialized before being used in memory operations, effectively preventing the kernel from attempting to access invalid memory addresses. System administrators should prioritize updating to kernel versions that include this patch, particularly in production environments where virtualized network devices are actively utilized. Additionally, monitoring systems for kernel oops messages or unexpected reboots can help detect potential exploitation attempts. The fix aligns with ATT&CK technique T1547.006 for kernel rootkits and emphasizes the importance of proper kernel memory management practices. Organizations should also consider implementing automated patch management processes to ensure timely deployment of security fixes across their infrastructure, as this vulnerability demonstrates how seemingly minor code path issues can lead to critical system instability.