Executive brief
The Solarflare network interface card (NIC) driver in the Linux kernel crashes when reading network statistics while the NIC is resetting. A NULL pointer dereference occurs when the kernel attempts to access hardware statistics during an ethtool selftest or reset operation, causing a kernel panic that renders the affected network interface unavailable.
Technical details
A NULL pointer dereference vulnerability exists in the efx_net_stats() function (implementing .ndo_get_stats64) of the Solarflare EF10 NIC driver. When called during NIC reset or ethtool selftest, the nic_data->mc_stats pointer is freed and set to NULL, but the efx_ef10_update_stats_pf() function still attempts to read from it without validation. The vulnerability is triggered when efx_nic_copy_stats() is called with a NULL pointer, causing the kernel to crash at address 0x38. The fix adds a NULL check before accessing mc_stats and wraps the memory free operation with stats_lock to prevent a TOCTTOU race condition. No authentication or user interaction is required; any privileged process monitoring network statistics can trigger the crash.
Affected products
- Linux Linux kernel Multiple versions affected (patch backported to stable kernels 4.19.y through 6.12.y and later)
Timeline
- 2023-06-23: disclosed: Upstream commit by Edward Cree
- 2023-07-11: patched: Backport to stable kernels began
- 2025-12-24: advisory: CVE-2023-54156 published