BaseFortify

Publication date: 2025-10-04

Last updated on: 2026-06-18

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-04

Last Modified

2026-06-18

Generated

2026-07-06

AI Q&A

2025-10-04

EPSS Evaluated

2026-07-05

NVD

CVE-2023-53543

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.5
linux	linux_kernel	6.5
linux	linux_kernel	6.5
linux	linux_kernel	6.5
linux	linux_kernel	6.5
linux	linux_kernel	6.5
linux	linux_kernel	From 5.16 (inc) to 6.1.47 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.4.12 (exc)
linux	linux_kernel	From 5.15.198 (inc) to 5.15.209 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's vdpa component. It involves a missing attribute policy in the vdpa_nl_policy structure, which is used to validate netlink attributes (nlattr) when parsing incoming netlink messages. Without this policy, the parsing can produce an invalid nlattr pointer, potentially leading to an out-of-bounds (OOB) read similar to a previous vulnerability (CVE-2023-3773). The patch adds the missing policy to prevent such invalid parsing and OOB reads.

Impact Analysis

This vulnerability can lead to an out-of-bounds read in the Linux kernel when handling vdpa netlink messages. Such an OOB read could cause system instability, crashes, or potentially allow an attacker to read sensitive kernel memory, which may compromise system security.

Hi! I’m here to help you understand CVE-2023-53543. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70