CVE-2023-53340Improper Validation of Array Index in Linux

Severity
7.8HIGHNVD
EPSS
0.0%
top 97.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 17

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a general command, which is not used by mlx5 driver. In case such command is failed, mlx5 is trying to collect the failure data, However, mlx5 doesn't create a storage for this command, since mlx5 doesn't use it. This lead to array-index-out-of-bounds error. Fix it by checking whether the command is known before collecting the failure data.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

NVDlinux/linux_kernel5.186.1.31+2
Debianlinux/linux_kernel< 6.1.37-1+2
CVEListV5linux/linux34f46ae0d4b38e83cfb26fb6f06b5b5efea47fdc411e4d6caa7f7169192b8dacc8421ac4fd64a354+3
debiandebian/linux< linux 6.1.37-1 (bookworm)

Patches

🔴Vulnerability Details

2
GHSA
GHSA-cx33-4cq6-86x6: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a2025-09-17
OSV
CVE-2023-53340: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a g2025-09-17

📋Vendor Advisories

2
Red Hat
kernel: net/mlx5: Collect command failures data only for known commands2025-09-17
Debian
CVE-2023-53340: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: C...2023
CVE-2023-53340 — Improper Validation of Array Index | cvebase