CVE-2023-53110 net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
A race condition in the Linux kernel SMC-R module can cause a NULL pointer dereference, leading to a system panic and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53110?
CVE-2023-53110 is a high-severity vulnerability in Linux kernel, published on 2 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
When performing a stress test on SMC-R by rmmod mlx5_ib driver during the wrk/nginx test, we found that there is a probability of triggering a panic while terminating all link groups.
This issue dues to the race between smc_smcr_terminate_all() and smc_buf_create().
smc_smcr_terminate_all
smc_buf_create /* init */ conn->sndbuf_desc = NULL; ...
__smc_lgr_terminate smc_conn_kill smc_close_abort smc_cdc_get_slot_and_msg_send
__softirqentry_text_start smc_wr_tx_process_cqe smc_cdc_tx_handler READ(conn->sndbuf_desc->len); /* panic dues to NULL sndbuf_desc */
conn->sndbuf_desc = xxx;
This patch tries to fix the issue by always to check the sndbuf_desc before send any cdc msg, to make sure that no null pointer is seen during cqe processing.
Weakness: CWE-476
Which versions are affected by CVE-2023-53110?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53110?
Apply the vendor's patch.
Is CVE-2023-53110 being exploited?
There is no known exploitation of CVE-2023-53110 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53110, DEBIAN-CVE-2023-53110, GHSA-vm5r-r7q6-4cwx, UBUNTU-CVE-2023-53110.