net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() (CVE-2023-54237) | HOL Guard CVE

Critical · CVSS 9.8CVE-2023-54237

net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()

Answer in brief

CVE-2023-54237 records a Critical severity (CVSS 9.8) vulnerability in net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Dec 30, 2025Updated Sep 14, 2026Source checked Sep 21, 2026First seen by HOL Aug 5, 2026Material review Sep 14, 2026

Upstream Advisory

Key facts

Risk: Critical · CVSS 9.8
Exploitation: Not marked as known exploited
Affected software: 3 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=2d2209f2018943d4152a21eff5b76f1952e0b435 <f2f46de98c11d41ac8d22765f47ba54ce5480a5b \|\| >=2d2209f2018943d4152a21eff5b76f1952e0b435 <0c764cc271d3aa6528ae1b3394babf34ac01f775 \|\| >=2d2209f2018943d4152a21eff5b76f1952e0b435 <e40b801b3603a8f90b46acbacdea3505c27f01c0	f2f46de98c11d41ac8d22765f47ba54ce5480a5b, 0c764cc271d3aa6528ae1b3394babf34ac01f775, e40b801b3603a8f90b46acbacdea3505c27f01c0
Linux/Linuxgeneric	5.8	Not reported
Linux/Linuxgeneric	>=2d2209f2018943d4152a21eff5b76f1952e0b435 <fe35c24b730d38b421da93ac5d493cb4495e8e54 \|\| >=2d2209f2018943d4152a21eff5b76f1952e0b435 <f2f46de98c11d41ac8d22765f47ba54ce5480a5b \|\| >=2d2209f2018943d4152a21eff5b76f1952e0b435 <0c764cc271d3aa6528ae1b3394babf34ac01f775 \|\| >=2d2209f2018943d4152a21eff5b76f1952e0b435 <e40b801b3603a8f90b46acbacdea3505c27f01c0	fe35c24b730d38b421da93ac5d493cb4495e8e54, f2f46de98c11d41ac8d22765f47ba54ce5480a5b, 0c764cc271d3aa6528ae1b3394babf34ac01f775, e40b801b3603a8f90b46acbacdea3505c27f01c0

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to f2f46de98c11d41ac8d22765f47ba54ce5480a5b; Linux/Linux to fe35c24b730d38b421da93ac5d493cb4495e8e54 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Dec 30, 2025
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 5, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() There is a certain chance to trigger the following panic: PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:48" #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7 #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60 #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7 #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715 #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654 #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62 [exception RIP: ib_alloc_mr+19] RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004 RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000010 R14: ffff88c1ab040a50 R15: ffff88c1ea281d00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc] #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc] #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc] The reason here is that when the server tries to create a second link, smc_llc_srv_add_link() has no protection and may add a new link to link group. This breaks the security environment protected by llc_conf_mutex.

Quoted source text, attributed separately from HOL analysis.