GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54292 (GCVE-0-2023-54292)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:23 – Updated: 2026-08-05 09:19
VLAI
Title
RDMA/irdma: Fix data race on CQP request done
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP request done KCSAN detects a data race on cqp_request->request_done memory location which is accessed locklessly in irdma_handle_cqp_op while being updated in irdma_cqp_ce_handler. Annotate lockless intent with READ_ONCE/WRITE_ONCE to avoid any compiler optimizations like load fusing and/or KCSAN warning. [222808.417128] BUG: KCSAN: data-race in irdma_cqp_ce_handler [irdma] / irdma_wait_event [irdma] [222808.417532] write to 0xffff8e44107019dc of 1 bytes by task 29658 on cpu 5: [222808.417610] irdma_cqp_ce_handler+0x21e/0x270 [irdma] [222808.417725] cqp_compl_worker+0x1b/0x20 [irdma] [222808.417827] process_one_work+0x4d1/0xa40 [222808.417835] worker_thread+0x319/0x700 [222808.417842] kthread+0x180/0x1b0 [222808.417852] ret_from_fork+0x22/0x30 [222808.417918] read to 0xffff8e44107019dc of 1 bytes by task 29688 on cpu 1: [222808.417995] irdma_wait_event+0x1e2/0x2c0 [irdma] [222808.418099] irdma_handle_cqp_op+0xae/0x170 [irdma] [222808.418202] irdma_cqp_cq_destroy_cmd+0x70/0x90 [irdma] [222808.418308] irdma_puda_dele_rsrc+0x46d/0x4d0 [irdma] [222808.418411] irdma_rt_deinit_hw+0x179/0x1d0 [irdma] [222808.418514] irdma_ib_dealloc_device+0x11/0x40 [irdma] [222808.418618] ib_dealloc_device+0x2a/0x120 [ib_core] [222808.418823] __ib_unregister_device+0xde/0x100 [ib_core] [222808.418981] ib_unregister_device+0x22/0x40 [ib_core] [222808.419142] irdma_ib_unregister_device+0x70/0x90 [irdma] [222808.419248] i40iw_close+0x6f/0xc0 [irdma] [222808.419352] i40e_client_device_unregister+0x14a/0x180 [i40e] [222808.419450] i40iw_remove+0x21/0x30 [irdma] [222808.419554] auxiliary_bus_remove+0x31/0x50 [222808.419563] device_remove+0x69/0xb0 [222808.419572] device_release_driver_internal+0x293/0x360 [222808.419582] driver_detach+0x7c/0xf0 [222808.419592] bus_remove_driver+0x8c/0x150 [222808.419600] driver_unregister+0x45/0x70 [222808.419610] auxiliary_driver_unregister+0x16/0x30 [222808.419618] irdma_exit_module+0x18/0x1e [irdma] [222808.419733] __do_sys_delete_module.constprop.0+0x1e2/0x310 [222808.419745] __x64_sys_delete_module+0x1b/0x30 [222808.419755] do_syscall_64+0x39/0x90 [222808.419763] entry_SYSCALL_64_after_hwframe+0x63/0xcd [222808.419829] value changed: 0x01 -> 0x03
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 915cc7ac0f8e2a23675ee896e87f17c7d3c47089 , < c5b5dbcbf91f769b8eb25f88e32a1522f920f37a (git)
Affected: 915cc7ac0f8e2a23675ee896e87f17c7d3c47089 , < 5986e96be7d0b82e50a9c6b019ea3f1926fd8764 (git)
Affected: 915cc7ac0f8e2a23675ee896e87f17c7d3c47089 , < b8b90ba636e3861665aef9a3eab5fcf92839a2c5 (git)
Affected: 915cc7ac0f8e2a23675ee896e87f17c7d3c47089 , < f0842bb3d38863777e3454da5653d80b5fde6321 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.124 , ≤ 5.15.* (semver)
Unaffected: 6.1.43 , ≤ 6.1.* (semver)
Unaffected: 6.4.8 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/hw.c",
            "drivers/infiniband/hw/irdma/main.h",
            "drivers/infiniband/hw/irdma/utils.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c5b5dbcbf91f769b8eb25f88e32a1522f920f37a",
              "status": "affected",
              "version": "915cc7ac0f8e2a23675ee896e87f17c7d3c47089",
              "versionType": "git"
            },
            {
              "lessThan": "5986e96be7d0b82e50a9c6b019ea3f1926fd8764",
              "status": "affected",
              "version": "915cc7ac0f8e2a23675ee896e87f17c7d3c47089",
              "versionType": "git"
            },
            {
              "lessThan": "b8b90ba636e3861665aef9a3eab5fcf92839a2c5",
              "status": "affected",
              "version": "915cc7ac0f8e2a23675ee896e87f17c7d3c47089",
              "versionType": "git"
            },
            {
              "lessThan": "f0842bb3d38863777e3454da5653d80b5fde6321",
              "status": "affected",
              "version": "915cc7ac0f8e2a23675ee896e87f17c7d3c47089",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/hw.c",
            "drivers/infiniband/hw/irdma/main.h",
            "drivers/infiniband/hw/irdma/utils.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.124",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.43",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.8",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix data race on CQP request done\n\nKCSAN detects a data race on cqp_request-\u003erequest_done memory location\nwhich is accessed locklessly in irdma_handle_cqp_op while being\nupdated in irdma_cqp_ce_handler.\n\nAnnotate lockless intent with READ_ONCE/WRITE_ONCE to avoid any\ncompiler optimizations like load fusing and/or KCSAN warning.\n\n[222808.417128] BUG: KCSAN: data-race in irdma_cqp_ce_handler [irdma] / irdma_wait_event [irdma]\n\n[222808.417532] write to 0xffff8e44107019dc of 1 bytes by task 29658 on cpu 5:\n[222808.417610]  irdma_cqp_ce_handler+0x21e/0x270 [irdma]\n[222808.417725]  cqp_compl_worker+0x1b/0x20 [irdma]\n[222808.417827]  process_one_work+0x4d1/0xa40\n[222808.417835]  worker_thread+0x319/0x700\n[222808.417842]  kthread+0x180/0x1b0\n[222808.417852]  ret_from_fork+0x22/0x30\n\n[222808.417918] read to 0xffff8e44107019dc of 1 bytes by task 29688 on cpu 1:\n[222808.417995]  irdma_wait_event+0x1e2/0x2c0 [irdma]\n[222808.418099]  irdma_handle_cqp_op+0xae/0x170 [irdma]\n[222808.418202]  irdma_cqp_cq_destroy_cmd+0x70/0x90 [irdma]\n[222808.418308]  irdma_puda_dele_rsrc+0x46d/0x4d0 [irdma]\n[222808.418411]  irdma_rt_deinit_hw+0x179/0x1d0 [irdma]\n[222808.418514]  irdma_ib_dealloc_device+0x11/0x40 [irdma]\n[222808.418618]  ib_dealloc_device+0x2a/0x120 [ib_core]\n[222808.418823]  __ib_unregister_device+0xde/0x100 [ib_core]\n[222808.418981]  ib_unregister_device+0x22/0x40 [ib_core]\n[222808.419142]  irdma_ib_unregister_device+0x70/0x90 [irdma]\n[222808.419248]  i40iw_close+0x6f/0xc0 [irdma]\n[222808.419352]  i40e_client_device_unregister+0x14a/0x180 [i40e]\n[222808.419450]  i40iw_remove+0x21/0x30 [irdma]\n[222808.419554]  auxiliary_bus_remove+0x31/0x50\n[222808.419563]  device_remove+0x69/0xb0\n[222808.419572]  device_release_driver_internal+0x293/0x360\n[222808.419582]  driver_detach+0x7c/0xf0\n[222808.419592]  bus_remove_driver+0x8c/0x150\n[222808.419600]  driver_unregister+0x45/0x70\n[222808.419610]  auxiliary_driver_unregister+0x16/0x30\n[222808.419618]  irdma_exit_module+0x18/0x1e [irdma]\n[222808.419733]  __do_sys_delete_module.constprop.0+0x1e2/0x310\n[222808.419745]  __x64_sys_delete_module+0x1b/0x30\n[222808.419755]  do_syscall_64+0x39/0x90\n[222808.419763]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\n[222808.419829] value changed: 0x01 -\u003e 0x03"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - CQP requests are issued directly from remote packet processing \u2014 `irdma_handle_syn_pkt()` creates an AH via CQP on an incoming TCP SYN to an iWARP listener, `irdma_add_conn_est_qh()` and the connection-teardown paths issue qhash CQP ops, and the IEQ path creates AHs from remote out-of-order MPA segments. A remote peer can therefore drive both CQP submission and completion traffic that races on the shared flag byte.\nAC:L - The attacker controls both sides of the race by driving an arbitrary rate of concurrent CQP operations (SYN/connection churn remotely, or concurrent verbs locally), which also exhausts the static request pool and forces the `kzalloc`/`dynamic` path. Non-atomic byte-wide RMW on a byte shared by three flags collides reliably at high operation rates.\nPR:N - The remote CM path that issues CQP requests runs during TCP SYN/MPA handling, before any MPA or application-level authentication. Even on the local path, `/dev/infiniband/uverbs*` is world-accessible (mode 0666) under standard rdma-core udev rules, so no privileges are needed.\nUI:N - The race is triggered purely by attacker-generated connection or verbs traffic against an already-configured RDMA device; no action by any local user or administrator is required.\nS:U - The corruption and its consequences are entirely within the kernel\u0027s own security authority \u2014 the irdma driver\u0027s request objects and the resources it manages. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - A stale `request_done` makes `irdma_handle_cqp_op()` report success while the hardware op is still in flight, so the request object is recycled while still referenced by `cqp-\u003escratch_array`, and CQ/QP/MR/DMA memory is freed while the device still owns it. The resulting use-after-free on `kzalloc`\u0027d requests gives an attacker control over freed-object contents and hence a read primitive.\nI:H - The same use-after-free leads to `cqp_request-\u003ecallback_fcn(cqp_request)` being invoked on a concurrently reused object and to refcount underflow/double free; a lost update on the adjacent `dynamic` bit additionally causes `kfree()` of a pointer inside the `kcalloc`\u0027d `cqp_requests` array (invalid free / slab corruption). Both are exploitable for kernel memory writes and control-flow hijack.\nA:H - A lost `request_done` drives the waiter to the CQP timeout, which calls `ice_rdma_request_reset(pf, IIDC_PFR)` \u2014 a full PF reset of the NIC \u2014 and latches `rf-\u003ereset`, failing all further CQP ops. A lost `waiting` bit skips `irdma_hw_modify_qp_callback()`, leaving `wait_event(iwqp-\u003emod_qp_waitq, \u2026)` (no timeout, uninterruptible) hung permanently, plus the UAF paths cause outright panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:19:01.476Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c5b5dbcbf91f769b8eb25f88e32a1522f920f37a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5986e96be7d0b82e50a9c6b019ea3f1926fd8764"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8b90ba636e3861665aef9a3eab5fcf92839a2c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0842bb3d38863777e3454da5653d80b5fde6321"
        }
      ],
      "title": "RDMA/irdma: Fix data race on CQP request done",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54292",
    "datePublished": "2025-12-30T12:23:30.419Z",
    "dateReserved": "2025-12-30T12:06:44.527Z",
    "dateUpdated": "2026-08-05T09:19:01.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54292",
      "date": "2026-09-16",
      "epss": "0.00535",
      "percentile": "0.43844"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54292\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-30T13:16:18.280\",\"lastModified\":\"2026-08-04T11:16:39.487\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/irdma: Fix data race on CQP request done\\n\\nKCSAN detects a data race on cqp_request-\u003erequest_done memory location\\nwhich is accessed locklessly in irdma_handle_cqp_op while being\\nupdated in irdma_cqp_ce_handler.\\n\\nAnnotate lockless intent with READ_ONCE/WRITE_ONCE to avoid any\\ncompiler optimizations like load fusing and/or KCSAN warning.\\n\\n[222808.417128] BUG: KCSAN: data-race in irdma_cqp_ce_handler [irdma] / irdma_wait_event [irdma]\\n\\n[222808.417532] write to 0xffff8e44107019dc of 1 bytes by task 29658 on cpu 5:\\n[222808.417610]  irdma_cqp_ce_handler+0x21e/0x270 [irdma]\\n[222808.417725]  cqp_compl_worker+0x1b/0x20 [irdma]\\n[222808.417827]  process_one_work+0x4d1/0xa40\\n[222808.417835]  worker_thread+0x319/0x700\\n[222808.417842]  kthread+0x180/0x1b0\\n[222808.417852]  ret_from_fork+0x22/0x30\\n\\n[222808.417918] read to 0xffff8e44107019dc of 1 bytes by task 29688 on cpu 1:\\n[222808.417995]  irdma_wait_event+0x1e2/0x2c0 [irdma]\\n[222808.418099]  irdma_handle_cqp_op+0xae/0x170 [irdma]\\n[222808.418202]  irdma_cqp_cq_destroy_cmd+0x70/0x90 [irdma]\\n[222808.418308]  irdma_puda_dele_rsrc+0x46d/0x4d0 [irdma]\\n[222808.418411]  irdma_rt_deinit_hw+0x179/0x1d0 [irdma]\\n[222808.418514]  irdma_ib_dealloc_device+0x11/0x40 [irdma]\\n[222808.418618]  ib_dealloc_device+0x2a/0x120 [ib_core]\\n[222808.418823]  __ib_unregister_device+0xde/0x100 [ib_core]\\n[222808.418981]  ib_unregister_device+0x22/0x40 [ib_core]\\n[222808.419142]  irdma_ib_unregister_device+0x70/0x90 [irdma]\\n[222808.419248]  i40iw_close+0x6f/0xc0 [irdma]\\n[222808.419352]  i40e_client_device_unregister+0x14a/0x180 [i40e]\\n[222808.419450]  i40iw_remove+0x21/0x30 [irdma]\\n[222808.419554]  auxiliary_bus_remove+0x31/0x50\\n[222808.419563]  device_remove+0x69/0xb0\\n[222808.419572]  device_release_driver_internal+0x293/0x360\\n[222808.419582]  driver_detach+0x7c/0xf0\\n[222808.419592]  bus_remove_driver+0x8c/0x150\\n[222808.419600]  driver_unregister+0x45/0x70\\n[222808.419610]  auxiliary_driver_unregister+0x16/0x30\\n[222808.419618]  irdma_exit_module+0x18/0x1e [irdma]\\n[222808.419733]  __do_sys_delete_module.constprop.0+0x1e2/0x310\\n[222808.419745]  __x64_sys_delete_module+0x1b/0x30\\n[222808.419755]  do_syscall_64+0x39/0x90\\n[222808.419763]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\n[222808.419829] value changed: 0x01 -\u003e 0x03\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nRDMA/irdma: Corregir condici\u00f3n de carrera de datos en la finalizaci\u00f3n de solicitud CQP\\n\\nKCSAN detecta una condici\u00f3n de carrera de datos en la ubicaci\u00f3n de memoria cqp_request-\u0026gt;request_done, a la cual se accede sin bloqueo en irdma_handle_cqp_op mientras se actualiza en irdma_cqp_ce_handler.\\n\\nAnotar la intenci\u00f3n sin bloqueo con READ_ONCE/WRITE_ONCE para evitar cualquier optimizaci\u00f3n del compilador como la fusi\u00f3n de cargas y/o la advertencia de KCSAN.\\n\\n[222808.417128] BUG: KCSAN: condici\u00f3n de carrera de datos en irdma_cqp_ce_handler [irdma] / irdma_wait_event [irdma]\\n\\n[222808.417532] escritura en 0xffff8e44107019dc de 1 bytes por la tarea 29658 en la cpu 5:\\n[222808.417610] irdma_cqp_ce_handler+0x21e/0x270 [irdma]\\n[222808.417725] cqp_compl_worker+0x1b/0x20 [irdma]\\n[222808.417827] process_one_work+0x4d1/0xa40\\n[222808.417835] worker_thread+0x319/0x700\\n[222808.417842] kthread+0x180/0x1b0\\n[222808.417852] ret_from_fork+0x22/0x30\\n\\n[222808.417918] lectura en 0xffff8e44107019dc de 1 bytes por la tarea 29688 en la cpu 1:\\n[222808.417995] irdma_wait_event+0x1e2/0x2c0 [irdma]\\n[222808.418099] irdma_handle_cqp_op+0xae/0x170 [irdma]\\n[222808.418202] irdma_cqp_cq_destroy_cmd+0x70/0x90 [irdma]\\n[222808.418308] irdma_puda_dele_rsrc+0x46d/0x4d0 [irdma]\\n[222808.418411] irdma_rt_deinit_hw+0x179/0x1d0 [irdma]\\n[222808.418514] irdma_ib_dealloc_device+0x11/0x40 [irdma]\\n[222808.418618] ib_dealloc_device+0x2a/0x120 [ib_core]\\n[222808.418823] __ib_unregister_device+0xde/0x100 [ib_core]\\n[222808.418981] ib_unregister_device+0x22/0x40 [ib_core]\\n[222808.419142] irdma_ib_unregister_device+0x70/0x90 [irdma]\\n[222808.419248] i40iw_close+0x6f/0xc0 [irdma]\\n[222808.419352] i40e_client_device_unregister+0x14a/0x180 [i40e]\\n[222808.419450] i40iw_remove+0x21/0x30 [irdma]\\n[222808.419554] auxiliary_bus_remove+0x31/0x50\\n[222808.419563] device_remove+0x69/0xb0\\n[222808.419572] device_release_driver_internal+0x293/0x360\\n[222808.419582] driver_detach+0x7c/0xf0\\n[222808.419592] bus_remove_driver+0x8c/0x150\\n[222808.419600] driver_unregister+0x45/0x70\\n[222808.419610] auxiliary_driver_unregister+0x16/0x30\\n[222808.419618] irdma_exit_module+0x18/0x1e [irdma]\\n[222808.419733] __do_sys_delete_module.constprop.0+0x1e2/0x310\\n[222808.419745] __x64_sys_delete_module+0x1b/0x30\\n[222808.419755] do_syscall_64+0x39/0x90\\n[222808.419763] entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\n[222808.419829] valor cambiado: 0x01 -\u0026gt; 0x03\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/irdma/hw.c\",\"drivers/infiniband/hw/irdma/main.h\",\"drivers/infiniband/hw/irdma/utils.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"915cc7ac0f8e2a23675ee896e87f17c7d3c47089\",\"lessThan\":\"c5b5dbcbf91f769b8eb25f88e32a1522f920f37a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"915cc7ac0f8e2a23675ee896e87f17c7d3c47089\",\"lessThan\":\"5986e96be7d0b82e50a9c6b019ea3f1926fd8764\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"915cc7ac0f8e2a23675ee896e87f17c7d3c47089\",\"lessThan\":\"b8b90ba636e3861665aef9a3eab5fcf92839a2c5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"915cc7ac0f8e2a23675ee896e87f17c7d3c47089\",\"lessThan\":\"f0842bb3d38863777e3454da5653d80b5fde6321\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/irdma/hw.c\",\"drivers/infiniband/hw/irdma/main.h\",\"drivers/infiniband/hw/irdma/utils.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.124\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.43\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.8\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5986e96be7d0b82e50a9c6b019ea3f1926fd8764\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b8b90ba636e3861665aef9a3eab5fcf92839a2c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c5b5dbcbf91f769b8eb25f88e32a1522f920f37a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0842bb3d38863777e3454da5653d80b5fde6321\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:12:24+00:00",
      "cve": "CVE-2023-54292",
      "id": "CVE-2023-54292",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/irdma: Fix data race on CQP request done",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54292.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:18:13Z",
      "cve": "CVE-2023-54292",
      "id": "CVE-2023-54292",
      "initial_release_date": "2025-12-31T00:26:33Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "295",
      "product_status:recommended": "437",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54292",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54292.json",
      "version": "38"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.