CVE-2023-53632

A locking flaw in the Mellanox mlx5 Ethernet driver allowed calls to xdp_set_features() without holding the required rtnetlink (RTNL) lock.

A local administrator switching device profiles (for example, from an uplink representor to a Network Interface Card profile) could trigger notifier paths without proper synchronization, leading to kernel warnings and potential denial of service (system instability or crash).

The issue stems from invoking XDP feature updates on a registered network device without the RTNL lock, which can race with network-device notifiers during profile changes in mlx5e. The fix ensures the RTNL lock is taken where required before updating XDP features.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module mlx5_core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.