7.8

CVE-2023-54048: linux

CVSS: 7.8v3.1HighDeferred
AliasesUBUNTU-CVE-2023-54048DEBIAN-CVE-2023-54048
Published 24-12-2025Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2023-54048 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.4% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.20%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 13
RHSA-2024:2394RHSA-2026:75746RHSA-2026:75747SUSE-SU-2026:0263-1SUSE-SU-2026:0278-1SUSE-SU-2026:0281-1

Timeline

  1. 24-12-2025
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Prevent handling any completions after qp destroy HW may generate completions that indicates QP is destroyed. Driver should not be scheduling any more completion handlers for this QP, after the QP is destroyed. Since CQs are active during the QP destroy, driver may still schedule completion handlers. This can cause a race where the destroy_cq and poll_cq running simultaneously. Snippet of kernel panic while doing bnxt_re driver load unload in loop. This indicates a poll after the CQ is freed. [77786.481636] Call Trace: [77786.481640]  <TASK> [77786.481644]  bnxt_re_poll_cq+0x14a/0x620 [bnxt_re] [77786.481658]  ? kvm_clock_read+0x14/0x30 [77786.481693]  __ib_process_cq+0x57/0x190 [ib_core] [77786.481728]  ib_cq_poll_work+0x26/0x80 [ib_core] [77786.481761]  process_one_work+0x1e5/0x3f0 [77786.481768]  worker_thread+0x50/0x3a0 [77786.481785]  ? __pfx_worker_thread+0x10/0x10 [77786.481790]  kthread+0xe2/0x110 [77786.481794]  ? __pfx_kthread+0x10/0x10 [77786.481797]  ret_from_fork+0x2c/0x50 To avoid this, complete all completion handlers before returning the destroy QP. If free_cq is called soon after destroy_qp, IB stack will cancel the CQ work before invoking the destroy_cq verb and this will prevent any race mentioned.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

0.00 pp

From 0.20% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu123 products
  • linuxAll versions (No fix recorded) | < 5.15.0-88.98
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1049.54
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.52-1 | < 6.4.11-1
Linux1 product
  • linux≥ 1ac5a404797523cedaf424a3aaa3cf8f9548dff8, < b79a0e71d6e8692e0b6da05f8aaa7d69191cf7e7 | ≥ 1ac5a404797523cedaf424a3aaa3cf8f9548dff8, < b8500538b8f5b2cd86b02754c8de83eaa7a2d6ba | ≥ 1ac5a404797523cedaf424a3aaa3cf8f9548dff8, < 7faa6097694164380ed19600c7a7993d071270b9 | ≥ 1ac5a404797523cedaf424a3aaa3cf8f9548dff8, < b5bbc6551297447d3cca55cf907079e206e9cd82 | 4.11

3 vendors · 125 products

References

7 links