CVE-2023-53393
BaseFortify
Publication date: 2025-09-18
Last updated on: 2025-12-12
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.16 (inc) to 5.15.87 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.0.19 (exc) |
| linux | linux_kernel | From 6.1 (inc) to 6.1.5 (exc) |
| linux | linux_kernel | 6.2 |
| linux | linux_kernel | 6.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's RDMA mlx5 driver, specifically in the mlx5_ib_get_hw_stats() function. When this function is used for the device (with port_num = 0), it incorrectly passes port_num down the stack without adjustment, while some functions expect port_num to be 1 or greater. This mismatch can cause a kernel oops (crash) due to an invalid memory access (page fault) when trying to handle hardware statistics.
How can this vulnerability impact me? :
The vulnerability can cause the Linux kernel to crash (kernel oops) when the mlx5_ib_get_hw_stats() function is called with port_num = 0. This can lead to system instability or downtime, affecting the availability of systems using the affected RDMA mlx5 driver.
What immediate steps should I take to mitigate this vulnerability?
Update the Linux kernel to a version that includes the fix for this vulnerability, where mlx5_ib_get_hw_stats() properly handles port_num by setting it to 1 to avoid the oops. Until then, avoid using mlx5_ib_get_hw_stats() with port_num = 0 to prevent kernel crashes.