CVE-2023-54195

A NULL pointer dereference flaw was found in the Linux kernel's RxRPC/AFS networking stack. When making an AFS call, the call timer can expire before a connection is assigned if the call gets stalled waiting for a connection. This causes a NULL pointer dereference in rxrpc_alloc_txbuf() when attempting to send an ACK.

This primarily affects AFS filesystem users. Direct exploitation from userspace via AF_RXRPC sockets is prevented as sendmsg() returns EBUSY in the vulnerable state. The issue requires specific timing conditions where connection establishment is delayed while the call timer expires.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.