GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54156 (GCVE-0-2023-54156)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:07 – Updated: 2026-08-05 09:17
VLAI
Title
sfc: fix crash when reading stats while NIC is resetting
Summary
In the Linux kernel, the following vulnerability has been resolved: sfc: fix crash when reading stats while NIC is resetting efx_net_stats() (.ndo_get_stats64) can be called during an ethtool selftest, during which time nic_data->mc_stats is NULL as the NIC has been fini'd. In this case do not attempt to fetch the latest stats from the hardware, else we will crash on a NULL dereference: BUG: kernel NULL pointer dereference, address: 0000000000000038 RIP efx_nic_update_stats abridged calltrace: efx_ef10_update_stats_pf efx_net_stats dev_get_stats dev_seq_printf_stats Skipping the read is safe, we will simply give out stale stats. To ensure that the free in efx_ef10_fini_nic() does not race against efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the efx->stats_lock in fini_nic (it is already held across update_stats).
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d3142c193dca9a2f6878f4128ce1aaf221bb3f99 , < cb1aa7cc562cab6a87ea33574c8c65f2d2fd7aeb (git)
Affected: d3142c193dca9a2f6878f4128ce1aaf221bb3f99 , < 91f4ef204e731565afdc6c2a7fcf509a3fd6fd67 (git)
Affected: d3142c193dca9a2f6878f4128ce1aaf221bb3f99 , < 446f5567934331923d0aec4ce045e4ecb0174aae (git)
Affected: d3142c193dca9a2f6878f4128ce1aaf221bb3f99 , < 470152d76b3ed107d172ea46acc4bfa941f20b4b (git)
Affected: d3142c193dca9a2f6878f4128ce1aaf221bb3f99 , < aba32b4c58112960c0c708703ca6b44dc8944082 (git)
Affected: d3142c193dca9a2f6878f4128ce1aaf221bb3f99 , < d1b355438b8325a486f087e506d412c4e852f37b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 5.10.188 , ≤ 5.10.* (semver)
Unaffected: 5.15.121 , ≤ 5.15.* (semver)
Unaffected: 6.1.39 , ≤ 6.1.* (semver)
Unaffected: 6.3.13 , ≤ 6.3.* (semver)
Unaffected: 6.4.4 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/sfc/ef10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cb1aa7cc562cab6a87ea33574c8c65f2d2fd7aeb",
              "status": "affected",
              "version": "d3142c193dca9a2f6878f4128ce1aaf221bb3f99",
              "versionType": "git"
            },
            {
              "lessThan": "91f4ef204e731565afdc6c2a7fcf509a3fd6fd67",
              "status": "affected",
              "version": "d3142c193dca9a2f6878f4128ce1aaf221bb3f99",
              "versionType": "git"
            },
            {
              "lessThan": "446f5567934331923d0aec4ce045e4ecb0174aae",
              "status": "affected",
              "version": "d3142c193dca9a2f6878f4128ce1aaf221bb3f99",
              "versionType": "git"
            },
            {
              "lessThan": "470152d76b3ed107d172ea46acc4bfa941f20b4b",
              "status": "affected",
              "version": "d3142c193dca9a2f6878f4128ce1aaf221bb3f99",
              "versionType": "git"
            },
            {
              "lessThan": "aba32b4c58112960c0c708703ca6b44dc8944082",
              "status": "affected",
              "version": "d3142c193dca9a2f6878f4128ce1aaf221bb3f99",
              "versionType": "git"
            },
            {
              "lessThan": "d1b355438b8325a486f087e506d412c4e852f37b",
              "status": "affected",
              "version": "d3142c193dca9a2f6878f4128ce1aaf221bb3f99",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/sfc/ef10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.188",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.121",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.39",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.13",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.4",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: fix crash when reading stats while NIC is resetting\n\nefx_net_stats() (.ndo_get_stats64) can be called during an ethtool\n selftest, during which time nic_data-\u003emc_stats is NULL as the NIC has\n been fini\u0027d.  In this case do not attempt to fetch the latest stats\n from the hardware, else we will crash on a NULL dereference:\n    BUG: kernel NULL pointer dereference, address: 0000000000000038\n    RIP efx_nic_update_stats\n    abridged calltrace:\n    efx_ef10_update_stats_pf\n    efx_net_stats\n    dev_get_stats\n    dev_seq_printf_stats\nSkipping the read is safe, we will simply give out stale stats.\nTo ensure that the free in efx_ef10_fini_nic() does not race against\n efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the\n efx-\u003estats_lock in fini_nic (it is already held across update_stats)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local interfaces that read netdev statistics \u2014 /proc/net/dev, /sys/class/net/*/statistics/*, rtnetlink RTM_GETLINK, or ethtool -S \u2014 all requiring local access to the host. No remote peer can drive `.ndo_get_stats64`.\nAC:L - The attacker fully controls the read side and the vulnerable state persists for the entire duration of a reset or offline BIST selftest (seconds), so a simple polling loop hits it deterministically rather than winning a tight race; in a delegated-netns/SR-IOV deployment the attacker holds CAP_NET_ADMIN over the port and drives both sides (ethtool -t plus concurrent stats reads).\nPR:L - Reading /proc/net/dev or the sysfs statistics files requires no capability whatsoever, only an unprivileged local account; where the attacker also triggers the reset, CAP_NET_ADMIN over a namespace-delegated port is obtainable by an unprivileged user and counts as Low per kernel scoring guidance.\nUI:N - No victim action is needed \u2014 the attacker polls statistics continuously and the crash fires on the next reset, and in the strongest scenario the attacker initiates the reset themselves.\nS:U - The corruption and crash are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unsynchronized kfree lets `efx_nic_update_stats()` read a freed (and potentially reallocated) kmalloc-1k object and export its 16/32/64-bit contents to unprivileged userspace as network stat counters, disclosing freed kernel heap data; UAF read primitives are scored High.\nI:H - In the same race `efx_nic_copy_stats()` memcpy()s ~768 bytes of DMA\u0027d MAC counters into the freed buffer, repeating for up to 10 ms in its retry loop, giving a use-after-free write into a sprayable slab with counter values an attacker can influence by shaping traffic to the NIC.\nA:H - The documented outcome is a kernel NULL pointer dereference oops at 0x38 in `efx_nic_update_stats()`, taken while holding `spin_lock_bh(\u0026efx-\u003estats_lock)` \u2014 the lock is then never released, so every later stats reader spins with BH disabled, producing a hang on top of the oops (or an immediate panic where panic_on_oops is set)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:42.126Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cb1aa7cc562cab6a87ea33574c8c65f2d2fd7aeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/91f4ef204e731565afdc6c2a7fcf509a3fd6fd67"
        },
        {
          "url": "https://git.kernel.org/stable/c/446f5567934331923d0aec4ce045e4ecb0174aae"
        },
        {
          "url": "https://git.kernel.org/stable/c/470152d76b3ed107d172ea46acc4bfa941f20b4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/aba32b4c58112960c0c708703ca6b44dc8944082"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1b355438b8325a486f087e506d412c4e852f37b"
        }
      ],
      "title": "sfc: fix crash when reading stats while NIC is resetting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54156",
    "datePublished": "2025-12-24T13:07:06.043Z",
    "dateReserved": "2025-12-24T13:02:52.530Z",
    "dateUpdated": "2026-08-05T09:17:42.126Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54156",
      "date": "2026-09-15",
      "epss": "0.00204",
      "percentile": "0.10615"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54156\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:17.630\",\"lastModified\":\"2026-08-04T11:16:34.440\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsfc: fix crash when reading stats while NIC is resetting\\n\\nefx_net_stats() (.ndo_get_stats64) can be called during an ethtool\\n selftest, during which time nic_data-\u003emc_stats is NULL as the NIC has\\n been fini\u0027d.  In this case do not attempt to fetch the latest stats\\n from the hardware, else we will crash on a NULL dereference:\\n    BUG: kernel NULL pointer dereference, address: 0000000000000038\\n    RIP efx_nic_update_stats\\n    abridged calltrace:\\n    efx_ef10_update_stats_pf\\n    efx_net_stats\\n    dev_get_stats\\n    dev_seq_printf_stats\\nSkipping the read is safe, we will simply give out stale stats.\\nTo ensure that the free in efx_ef10_fini_nic() does not race against\\n efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the\\n efx-\u003estats_lock in fini_nic (it is already held across update_stats).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/sfc/ef10.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d3142c193dca9a2f6878f4128ce1aaf221bb3f99\",\"lessThan\":\"cb1aa7cc562cab6a87ea33574c8c65f2d2fd7aeb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3142c193dca9a2f6878f4128ce1aaf221bb3f99\",\"lessThan\":\"91f4ef204e731565afdc6c2a7fcf509a3fd6fd67\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3142c193dca9a2f6878f4128ce1aaf221bb3f99\",\"lessThan\":\"446f5567934331923d0aec4ce045e4ecb0174aae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3142c193dca9a2f6878f4128ce1aaf221bb3f99\",\"lessThan\":\"470152d76b3ed107d172ea46acc4bfa941f20b4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3142c193dca9a2f6878f4128ce1aaf221bb3f99\",\"lessThan\":\"aba32b4c58112960c0c708703ca6b44dc8944082\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d3142c193dca9a2f6878f4128ce1aaf221bb3f99\",\"lessThan\":\"d1b355438b8325a486f087e506d412c4e852f37b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/sfc/ef10.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.188\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.121\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.39\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.13\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.4\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/446f5567934331923d0aec4ce045e4ecb0174aae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/470152d76b3ed107d172ea46acc4bfa941f20b4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/91f4ef204e731565afdc6c2a7fcf509a3fd6fd67\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aba32b4c58112960c0c708703ca6b44dc8944082\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cb1aa7cc562cab6a87ea33574c8c65f2d2fd7aeb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d1b355438b8325a486f087e506d412c4e852f37b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:14:38+00:00",
      "cve": "CVE-2023-54156",
      "id": "CVE-2023-54156",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sfc: fix crash when reading stats while NIC is resetting",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54156.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T17:05:15Z",
      "cve": "CVE-2023-54156",
      "id": "CVE-2023-54156",
      "initial_release_date": "2025-12-25T00:54:20Z",
      "product_status:known_affected": "401",
      "product_status:known_not_affected": "282",
      "product_status:recommended": "437",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54156",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54156.json",
      "version": "40"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.