---
id: CVE-2023-53110
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()

  When performing a stress test on SMC-R by rmmod mlx5_ib driver
  during the wrk/nginx test, we found that there is …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()

  When performing a stress test on SMC-R by rmmod mlx5_ib driver
  during the wrk/nginx test, we found that there is …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.5, < 5.10.176'
  - 'linux_kernel >= 5.11, < 5.15.104'
  - 'linux_kernel >= 5.16, < 6.1.21'
  - 'linux_kernel >= 6.2, < 6.2.8'
  - linux_kernel = 6.3
patched:
  - linux_kernel 6.2.8
published: '2025-05-02'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:37.977'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-53110'
references:
  - url: 'https://git.kernel.org/stable/c/22a825c541d775c1dbe7b2402786025acad6727b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/31817c530768b0199771ec6019571b4f0ddbf230'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3c270435db8aa34929263dddae8fd050f5216ecb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3ebac7cf0a184a8102821a7a00203f02bebda83c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b108bd9e6be000492ebebe867daa699285978a10'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53110.json
  - url: 'https://access.redhat.com/security/cve/CVE-2023-53110'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2363781'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2023-53110'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-53110'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025050227-CVE-2023-53110-2b28@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2023:7077'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00476
epssPercentile: 0.40923
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:33:55.502360Z'
scores:
  nvd: 7.5
  vendor: 5.5
  cna: 7.5
ingestedAt: '2026-10-15T22:48:25.390Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()

When performing a stress test on SMC-R by rmmod mlx5_ib driver
during the wrk/nginx test, we found that there is a probability
of triggering a panic while terminating all link groups.

This issue dues to the race between smc_smcr_terminate_all()
and smc_buf_create().

			smc_smcr_terminate_all

smc_buf_create
/* init */
conn->sndbuf_desc = NULL;
...

			__smc_lgr_terminate
				smc_conn_kill
					smc_close_abort
						smc_cdc_get_slot_and_msg_send

			__softirqentry_text_start
				smc_wr_tx_process_cqe
					smc_cdc_tx_handler
						READ(conn->sndbuf_desc->len);
						/* panic dues to NULL sndbuf_desc */

conn->sndbuf_desc = xxx;

This patch tries to fix the issue by always to check the sndbuf_desc
before send any cdc msg, to make sure that no null pointer is
seen during cqe processing.

## Affected

- `linux_kernel >= 5.5, < 5.10.176`
- `linux_kernel >= 5.11, < 5.15.104`
- `linux_kernel >= 5.16, < 6.1.21`
- `linux_kernel >= 6.2, < 6.2.8`
- `linux_kernel = 6.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.2.8`

## Vendor advisories

- **RHSA-2023:7077** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat CodeReady Linux Builder (v. 8) · released 2023-11-14 · [advisory](https://access.redhat.com/errata/RHSA-2023:7077)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53110.json)