CVE-2023-53110

A flaw was found in the Linux kernel's Shared Memory Communications (SMC) subsystem. A race condition between link group termination and buffer creation can cause the kernel to access an uninitialized memory pointer during message handling. A local user could trigger these conditions to crash the system, resulting in a Denial of Service (DoS).

A moderate impact flaw was found in the Linux kernel's Shared Memory Communications (SMC) subsystem in Red Hat Enterprise Linux 8 and 9. A race condition between the termination of SMC-R link groups (smc_smcr_terminate_all()) and connection buffer creation (smc_buf_create()) can leave the connection's send buffer descriptor (sndbuf_desc) NULL when a work request completion is processed in smc_cdc_tx_handler(), causing a NULL pointer dereference and kernel panic. A local user who can trigger termination of SMC-R link groups while new connections are being established could win this race and crash the system, resulting in a denial of service; confidentiality and integrity are not impacted. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those releases. The fix for the affected Red Hat Enterprise Linux 8 and 9 kernel and kernel-rt streams is deferred to a future update because this is a local denial of service that requires a rare race window during SMC-R link group teardown; the residual risk is a locally triggered kernel panic on systems using SMC-R. Red Hat rates this flaw Moderate (CVSS 5.5, local attack vector, low privileges required), which differs from the upstream CVE record's 7.5 score with a network attack vector; Red Hat's assessment reflects that triggering the race requires local system activity rather than remote network access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.