CVE-2023-53340 — Improper Validation of Array Index in Linux
Severity
7.8HIGHNVD
EPSS
0.0%
top 97.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 17
Description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Collect command failures data only for known commands
DEVX can issue a general command, which is not used by mlx5 driver.
In case such command is failed, mlx5 is trying to collect the failure
data, However, mlx5 doesn't create a storage for this command, since
mlx5 doesn't use it. This lead to array-index-out-of-bounds error.
Fix it by checking whether the command is known before collecting the
failure data.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages4 packages
▶CVEListV5linux/linux34f46ae0d4b38e83cfb26fb6f06b5b5efea47fdc — 411e4d6caa7f7169192b8dacc8421ac4fd64a354+3
Patches
🔴Vulnerability Details
2GHSA▶
GHSA-cx33-4cq6-86x6: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Collect command failures data only for known commands
DEVX can issue a↗2025-09-17
OSV▶
CVE-2023-53340: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a g↗2025-09-17