---
id: CVE-2023-53394
title: 'net/mlx5e: xsk: Fix crash on regular rq reactivation'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: xsk: Fix crash on regular rq reactivation

  When the regular rq is reactivated after the XSK socket is closed
  it could be reading stale cqes which eventually …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 082a9edf12fef88400172e7d1b131d65a3ed492e <
    ecf583abb07da326d5058dc6ba79dae58aa800d3
  - >-
    Linux >= 082a9edf12fef88400172e7d1b131d65a3ed492e <
    02a84eb2af6bea7871cd34264fb27f141f005fd9
  - >-
    Linux >= 082a9edf12fef88400172e7d1b131d65a3ed492e <
    39646d9bcd1a65d2396328026626859a1dab59d7
  - Linux 6.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-01-14T18:59:43.131324Z'
published: '2025-09-18'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:17:29.409Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53394'
references:
  - url: 'https://git.kernel.org/stable/c/ecf583abb07da326d5058dc6ba79dae58aa800d3'
  - url: 'https://git.kernel.org/stable/c/02a84eb2af6bea7871cd34264fb27f141f005fd9'
  - url: 'https://git.kernel.org/stable/c/39646d9bcd1a65d2396328026626859a1dab59d7'
tags:
  - cve.org
epss: 0.00154
epssPercentile: 0.04588
ingestedAt: '2026-11-03T11:43:15.786Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: xsk: Fix crash on regular rq reactivation

When the regular rq is reactivated after the XSK socket is closed
it could be reading stale cqes which eventually corrupts the rq.
This leads to no more traffic being received on the regular rq and a
crash on the next close or deactivation of the rq.

Kal Cuttler Conely reported this issue as a crash on the release
path when the xdpsock sample program is stopped (killed) and restarted
in sequence while traffic is running.

This patch flushes all cqes when during the rq flush. The cqe flushing
is done in the reset state of the rq. mlx5e_rq_to_ready code is moved
into the flush function to allow for this.

## Affected

- `Linux >= 082a9edf12fef88400172e7d1b131d65a3ed492e < ecf583abb07da326d5058dc6ba79dae58aa800d3`
- `Linux >= 082a9edf12fef88400172e7d1b131d65a3ed492e < 02a84eb2af6bea7871cd34264fb27f141f005fd9`
- `Linux >= 082a9edf12fef88400172e7d1b131d65a3ed492e < 39646d9bcd1a65d2396328026626859a1dab59d7`
- `Linux 6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.