CVE-2023-53340
published 2025-09-17CVE-2023-53340: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a general…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.20%
9.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Collect command failures data only for known commands
DEVX can issue a general command, which is not used by mlx5 driver.
In case such command is failed, mlx5 is trying to collect the failure
data, However, mlx5 doesn't create a storage for this command, since
mlx5 doesn't use it. This lead to array-index-out-of-bounds error.
Fix it by checking whether the command is known before collecting the
failure data.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.37-1 (bookworm) | linux 6.1.37-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 34f46ae0d4b38e83cfb26fb6f06b5b5efea47fdc < 411e4d6caa7f7169192b8dacc8421ac4fd64a354 | 411e4d6caa7f7169192b8dacc8421ac4fd64a354 |
| linux | linux | >= 34f46ae0d4b38e83cfb26fb6f06b5b5efea47fdc < d8b6f175235d7327b4e1b13216859e89496dfbd5 | d8b6f175235d7327b4e1b13216859e89496dfbd5 |
| linux | linux | >= 34f46ae0d4b38e83cfb26fb6f06b5b5efea47fdc < 2a0a935fb64ee8af253b9c6133bb6702fb152ac2 | 2a0a935fb64ee8af253b9c6133bb6702fb152ac2 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.37-1 | 6.1.37-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 5.18 < 6.1.31 | 6.1.31 |
| linux | linux_kernel | >= 6.2 < 6.3.5 | 6.3.5 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: net/mlx5: Collect command failures data only for known commands
vendor_redhat·2025-09-17·CVSS 7.8
CVE-2023-53340 [HIGH] CWE-787 kernel: net/mlx5: Collect command failures data only for known commands
kernel: net/mlx5: Collect command failures data only for known commands
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Collect command failures data only for known commands
DEVX can issue a general command, which is not used by mlx5 driver.
In case such command is failed, mlx5 is trying to collect the failure
data, However, mlx5 doesn't create a storage for this command, since
mlx5 doesn't use it. This lead to array-index-out-of-bounds error.
Fix it by checking whether the command is known before collecting the
failure data.
An out-of-bounds write vulnerability exists in the linux kernel, such that when DEVX issues a general command not used by the mlx5 driver, the mlx5 is trying to collect the failure data, However, mlx5 doesn't create a storage for this c
Debian
CVE-2023-53340: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: C...
vendor_debian·2023·CVSS 7.8
CVE-2023-53340 [HIGH] CVE-2023-53340: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: C...
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a general command, which is not used by mlx5 driver. In case such command is failed, mlx5 is trying to collect the failure data, However, mlx5 doesn't create a storage for this command, since mlx5 doesn't use it. This lead to array-index-out-of-bounds error. Fix it by checking whether the command is known before collecting the failure data.
Scope: local
bookworm: resolved (fixed in 6.1.37-1)
bullseye: resolved
forky: resolved (fixed in 6.3.7-1)
sid: resolved (fixed in 6.3.7-1)
trixie: resolved (fixed in 6.3.7-1)
GHSA
GHSA-cx33-4cq6-86x6: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Collect command failures data only for known commands
DEVX can issue a
ghsa_unreviewed·2025-09-17
CVE-2023-53340 [HIGH] CWE-129 GHSA-cx33-4cq6-86x6: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Collect command failures data only for known commands
DEVX can issue a
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Collect command failures data only for known commands
DEVX can issue a general command, which is not used by mlx5 driver.
In case such command is failed, mlx5 is trying to collect the failure
data, However, mlx5 doesn't create a storage for this command, since
mlx5 doesn't use it. This lead to array-index-out-of-bounds error.
Fix it by checking whether the command is known before collecting the
failure data.
OSV
CVE-2023-53340: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a g
osv·2025-09-17·CVSS 7.8
CVE-2023-53340 [HIGH] CVE-2023-53340: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a g
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a general command, which is not used by mlx5 driver. In case such command is failed, mlx5 is trying to collect the failure data, However, mlx5 doesn't create a storage for this command, since mlx5 doesn't use it. This lead to array-index-out-of-bounds error. Fix it by checking whether the command is known before collecting the failure data.
No detection rules found.
No public exploits indexed.
2025-09-17
Published