{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-21T09:49:49.767","vulnerabilities":[{"cve":{"id":"CVE-2023-54048","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2025-12-24T13:16:06.457","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Prevent handling any completions after qp destroy\n\nHW may generate completions that indicates QP is destroyed.\nDriver should not be scheduling any more completion handlers\nfor this QP, after the QP is destroyed. Since CQs are active\nduring the QP destroy, driver may still schedule completion\nhandlers. This can cause a race where the destroy_cq and poll_cq\nrunning simultaneously.\n\nSnippet of kernel panic while doing bnxt_re driver load unload in loop.\nThis indicates a poll after the CQ is freed. \n\n[77786.481636] Call Trace:\n[77786.481640]  <TASK>\n[77786.481644]  bnxt_re_poll_cq+0x14a/0x620 [bnxt_re]\n[77786.481658]  ? kvm_clock_read+0x14/0x30\n[77786.481693]  __ib_process_cq+0x57/0x190 [ib_core]\n[77786.481728]  ib_cq_poll_work+0x26/0x80 [ib_core]\n[77786.481761]  process_one_work+0x1e5/0x3f0\n[77786.481768]  worker_thread+0x50/0x3a0\n[77786.481785]  ? __pfx_worker_thread+0x10/0x10\n[77786.481790]  kthread+0xe2/0x110\n[77786.481794]  ? __pfx_kthread+0x10/0x10\n[77786.481797]  ret_from_fork+0x2c/0x50\n\nTo avoid this, complete all completion handlers before returning the\ndestroy QP. If free_cq is called soon after destroy_qp,  IB stack\nwill cancel the CQ work before invoking the destroy_cq verb and\nthis will prevent any race mentioned."}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7faa6097694164380ed19600c7a7993d071270b9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5bbc6551297447d3cca55cf907079e206e9cd82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b79a0e71d6e8692e0b6da05f8aaa7d69191cf7e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8500538b8f5b2cd86b02754c8de83eaa7a2d6ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}]}