CVE-2023-53556

A flaw was found in the Linux kernel's iavf driver. A local user with administrative capabilities can exploit a use-after-free vulnerability, caused by a mismatch in network interface (NAPI) list management functions. This can lead to dangling NAPI entries, resulting in a kernel crash and a Denial of Service (DoS).

A use-after-free in the Intel iavf driver could be triggered by a mismatch between netif_napi_add() and netif_napi_del(), leaving dangling NAPI entries and crashing in free_netdev(). Exploitation requires local administrative capabilities (SR-IOV toggling and channel reconfiguration), so the practical impact is mostly a kernel DoS rather than privilege escalation. For the CVSS the PR:H — because changing sriov_numvfs (PF) and ethtool -L (VF) requires CAP_SYS_ADMIN/CAP_NET_ADMIN.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.