CVE-2023-54206

A flaw was found in the Linux kernel’s networking traffic control flower classifier. The initialization of the filter IDR was moved too early in the fl_change() path, allowing concurrent access by multiple users while the structure was still in an inconsistent state. Under certain conditions, this race condition can lead to unexpected behavior including a NULL pointer dereference and kernel crash

This vulnerability is rated as Moderate severity because exploitation is limited to a local denial of service via kernel panic and requires specific timing alongside administrative network privileges or user namespace creation capabilities. Under typical Red Hat Enterprise Linux deployments, manipulating network traffic control filters requires elevated privileges (such as CAP_NET_ADMIN), substantially constraining unauthorized exposure. An unprivileged local attacker would only be able to trigger the race condition if unprivileged user namespaces are enabled. The flaw does not allow privilege escalation or compromise of system confidentiality or data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.