CVE-2023-54201

{
  "id": "CVE-2023-54201",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-12-30T13:16:08.210",
  "lastModified": "2026-10-28T19:10:00.193",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix wrong resources deallocation order\n\nWhen trying to destroy QP or CQ, we first decrease the refcount and\npotentially free memory regions allocated for the object and then\nrequest the device to destroy the object. If the device fails, the\nobject isn't fully destroyed so the user/IB core can try to destroy the\nobject again which will lead to underflow when trying to decrease an\nalready zeroed refcount.\n\nDeallocate resources in reverse order of allocating them to safely free\nthem."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRDMA/efa: Corrección del orden incorrecto de desasignación de recursos\n\nAl intentar destruir QP o CQ, primero disminuimos el contador de referencias y potencialmente liberamos regiones de memoria asignadas para el objeto y luego solicitamos al dispositivo que destruya el objeto. Si el dispositivo falla, el objeto no se destruye completamente, por lo que el usuario/núcleo de IB puede intentar destruir el objeto de nuevo, lo que provocará un desbordamiento negativo al intentar disminuir un contador de referencias ya puesto a cero.\n\nDesasignar los recursos en orden inverso al de su asignación para liberarlos de forma segura."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/infiniband/hw/efa/efa_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "ff6629f88c529b07d9704c656c64dae76910e3e9",
              "lessThan": "cf38960386f3cc4abf395e556af915e4babcafd2",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ff6629f88c529b07d9704c656c64dae76910e3e9",
              "lessThan": "e79db2f51a564fd4daa3e508b987df5e81c34b20",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ff6629f88c529b07d9704c656c64dae76910e3e9",
              "lessThan": "24f9884971f9b34915b67baacf7350a3f6f19ea4",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ff6629f88c529b07d9704c656c64dae76910e3e9",
              "lessThan": "dc202c57e9a1423aed528e4b8dc949509cd32191",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/infiniband/hw/efa/efa_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.7",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.7",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.53",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.4.16",
              "lessThanOrEqual": "6.4.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.5.3",
              "lessThanOrEqual": "6.5.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/24f9884971f9b34915b67baacf7350a3f6f19ea4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cf38960386f3cc4abf395e556af915e4babcafd2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dc202c57e9a1423aed528e4b8dc949509cd32191",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e79db2f51a564fd4daa3e508b987df5e81c34b20",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}