CVE-2023-54310

In the Linux kernel, the mptlan driver contains a use-after-free vulnerability in the mptlan_remove() function due to a race condition with the post_buckets_task workqueue. The mptlan_probe() function registers a workqueue that can be started by mpt_lan_wake_post_buckets_task(). During driver unload, mptlan_remove() calls free_netdev() without ensuring the workqueue has finished, allowing the work item to access freed memory (e.g., dev->mtu) [1][2][3].

To exploit this, an attacker requires local access and the ability to trigger module unloading while a work item is pending or executing. The race window occurs between the workqueue execution and the cleanup in mptlan_remove(), potentially leading to a use-after-free condition [1][2][3].

Successful exploitation could result in a denial of service (system crash) or, in some cases, privilege escalation if the freed memory is reallocated in a controlled manner. The official description does not detail exploitability but flags the risk [1][2][3].

The fix involves completing or canceling the workqueue before freeing the netdev, as implemented in the referenced stable kernel commits. Users should update to the latest stable kernel versions containing these patches [1][2][3].