PT-2025-53206 · Linux+1 · Linux Kernel+1

Published 2023-05-03 · Updated 2026-04-20 · CVE-2023-54129

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.4.210-g2e3169d8e1bc-dirty #17

Description The Linux kernel contains a flaw in the octeontx2-af driver related to the validation of the lmac type id field received from firmware during physical link changes. Specifically, when firmware provides an invalid lmac type id, it can lead to a kernel panic. The issue arises because the kernel derives the lmac type based on this ID without proper validation. The fix involves adding validation for the lmac type id field to prevent the kernel panic. The vulnerable code involves the strncpy function and the cgx link change handler function.

Recommendations Update the Linux kernel to version 5.4.210-g2e3169d8e1bc-dirty #17 or a later version to address this issue.

Exploit

Fix

RCE

Improper Resource Release

Weakness Enumeration

CWE-20

CWE-404

Related Identifiers

BDU:2026-02283

CVE-2023-54129

RHSA-2023:6583

Affected Products

Debian

Linux Kernel

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54129.json · Exploit
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2023-54129 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-54129 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02283 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-54129 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2023-54129 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-54129 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-54129 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-54129 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-54129 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-54129 · Security Note
• https://ubuntu.com/security/CVE-2023-54129 · Vendor Advisory
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3 · Note
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.16 · Note
• https://docs.bell-sw.com/security/cves/CVE-2023-54129 · Note