{"id":"CVE-2023-53110","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()\n\nWhen performing a stress test on SMC-R by rmmod mlx5_ib driver\nduring the wrk/nginx test, we found that there is …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()\n\nWhen performing a stress test on SMC-R by rmmod mlx5_ib driver\nduring the wrk/nginx test, we found that there is …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.5, < 5.10.176","linux_kernel >= 5.11, < 5.15.104","linux_kernel >= 5.16, < 6.1.21","linux_kernel >= 6.2, < 6.2.8","linux_kernel = 6.3"],"patched":["linux_kernel 6.2.8"],"published":"2025-05-02","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:17:37.977","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-53110","references":[{"url":"https://git.kernel.org/stable/c/22a825c541d775c1dbe7b2402786025acad6727b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/31817c530768b0199771ec6019571b4f0ddbf230","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3c270435db8aa34929263dddae8fd050f5216ecb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ebac7cf0a184a8102821a7a00203f02bebda83c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b108bd9e6be000492ebebe867daa699285978a10","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53110.json"},{"url":"https://access.redhat.com/security/cve/CVE-2023-53110"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2363781"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-53110"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53110"},{"url":"https://lore.kernel.org/linux-cve-announce/2025050227-CVE-2023-53110-2b28@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2023:7077"}],"tags":["nvd","csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.00476,"epssPercentile":0.40923,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-15T21:33:55.502360Z"},"scores":{"nvd":7.5,"vendor":5.5,"cna":7.5},"ingestedAt":"2026-10-15T22:48:25.390Z","slug":"CVE-2023-53110","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()\n\nWhen performing a stress test on SMC-R by rmmod mlx5_ib driver\nduring the wrk/nginx test, we found that there is a probability\nof triggering a panic while terminating all link groups.\n\nThis issue dues to the race between smc_smcr_terminate_all()\nand smc_buf_create().\n\n\t\t\tsmc_smcr_terminate_all\n\nsmc_buf_create\n/* init */\nconn->sndbuf_desc = NULL;\n...\n\n\t\t\t__smc_lgr_terminate\n\t\t\t\tsmc_conn_kill\n\t\t\t\t\tsmc_close_abort\n\t\t\t\t\t\tsmc_cdc_get_slot_and_msg_send\n\n\t\t\t__softirqentry_text_start\n\t\t\t\tsmc_wr_tx_process_cqe\n\t\t\t\t\tsmc_cdc_tx_handler\n\t\t\t\t\t\tREAD(conn->sndbuf_desc->len);\n\t\t\t\t\t\t/* panic dues to NULL sndbuf_desc */\n\nconn->sndbuf_desc = xxx;\n\nThis patch tries to fix the issue by always to check the sndbuf_desc\nbefore send any cdc msg, to make sure that no null pointer is\nseen during cqe processing.\n\n## Affected\n\n- `linux_kernel >= 5.5, < 5.10.176`\n- `linux_kernel >= 5.11, < 5.15.104`\n- `linux_kernel >= 5.16, < 6.1.21`\n- `linux_kernel >= 6.2, < 6.2.8`\n- `linux_kernel = 6.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.2.8`\n\n## Vendor advisories\n\n- **RHSA-2023:7077** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat CodeReady Linux Builder (v. 8) · released 2023-11-14 · [advisory](https://access.redhat.com/errata/RHSA-2023:7077)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53110.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":230025,"id":"CVE-2023-53110","ts":1793124770894,"field":"cvss","old":"5.5","new":"7.5"},{"seq":230024,"id":"CVE-2023-53110","ts":1793124770894,"field":"severity","old":"medium","new":"high"},{"seq":223755,"id":"CVE-2023-53110","ts":1792238388757,"field":"cvss","old":"7.5","new":"5.5"},{"seq":223754,"id":"CVE-2023-53110","ts":1792238388757,"field":"severity","old":"high","new":"medium"}]}