CVE-2023-53850

Root

Cause

A race condition exists in the Intel Ethernet Adaptive Virtual Function (iavf) driver. When the system closes the network device (netdev) while iavf_reset_task() is running, the __LINK_STATE_START flag is cleared, causing netif_running() to return false inside iavf_reinit_interrupt_scheme(). Consequently, iavf_free_traffic_irqs() is not called, leaving IRQ procfs entries behind.[1]

Exploitation

No special privileges are required; an administrator or a local user with sufficient permissions to trigger device resets or network interface changes could inadvertently trigger the race. The issue occurs during normal operation when a reset task is in progress and the interface is closed simultaneously.[1]

Impact

When the driver later calls pci_disable_msix(), the stale procfs entries cause a kernel warning (remove_proc_entry: removing non-empty directory) and a memory leak. This degrades system stability and may fill kernel logs with warnings, though it does not directly allow code execution or privilege escalation.[1]

Mitigation

The fix replaces reliance on netif_running() with an internal adapter state check: traffic IRQs are freed if the state is __IAVF_RUNNING. The patch is included in Linux kernel stable updates. Users should apply the latest kernel updates from their distribution.[1]