Linux kernel bnxt_re: device is deallocated before cleanup completes, giving a use-after-free on teardown

CVSS 7.8CVE-2023-53504Firmware, BMC & network fabriccurated

Impact

The Broadcom RoCE driver called ib_dealloc_device() before finishing device cleanup, so teardown touched a freed ib_device - a use-after-free in kernel context. Exposure is narrow: the path runs on driver unload, device removal or PCI reset, not on ordinary traffic, so this is primarily a crash or memory-corruption risk during fabric maintenance rather than something a tenant can drive. For operators with Broadcom RoCE NICs in GPU nodes it matters at exactly the wrong moment - during a NIC reset or driver reload intended to recover a node, which is when an unexpected panic is most expensive.

Who can reach it

Local and effectively privileged: reached by whoever can unload the bnxt_re module, remove the device, or trigger a PCI reset - root on the host, or a hardware-level event. Not reachable from a tenant pod. Only hosts with Broadcom RoCE (bnxt_re) adapters are affected.

What to do

Update to a fixed stable kernel (commits in the record; fix landed in the 6.5 series and backports) and reboot the node. Until the fix is in place, avoid bnxt_re module reload and hot-remove on production GPU nodes; schedule driver work as part of a node drain rather than as a live recovery step.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-53504 https://git.kernel.org/stable/c/c95863f6d970ef968e7c1f3c481f72a4b0734654 https://git.kernel.org/stable/c/5363fc488da579923edf6a2fdca3d3b651dd800b

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.