CVE-2023-53504

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF

ib_dealloc_device() should be called only after device cleanup. Fix the dealloc sequence.

The bug stems from calling ib_dealloc_device() before fully tearing down the bnxt_re device, which can leave in-flight users holding references and lead to a use-after-free during driver removal. The fix reorders teardown: unregister/cleanup first, then call ib_dealloc_device(). Impact is availability-only (kernel crash during device remove/unbind or module unload). For the CVSS the PR:H is because in typical setups because triggering the removal path (unbinding, hot-unplug, module unload, RDMA device management) is restricted to privileged administrators.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.