CVE-2023-53543 Details
Description
In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.
A vulnerability in the Linux kernel's Virtual Data Path Acceleration (vdpa) management has been addressed. The issue arose because the vdpa_nl_policy structure, responsible for validating netlink attributes, lacked a proper length check for the 'max vqp' attribute. This omission could have allowed illegal attributes to be parsed, potentially leading to an out-of-bounds read, similar to the issue described in CVE-2023-3773. The vulnerability affects several versions of the Linux kernel.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for upgrading the Linux kernel can be found in the official Linux documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/5d6ba607d6cb5c58a4ddf33381e18c83dbb4098f | kernel.org | Patch |
| https://git.kernel.org/stable/c/baed19c108ac8287425b93a44985bbe9a0b1af8d | kernel.org | Patch |
| https://git.kernel.org/stable/c/ea65e8b5e6b1a34deda7564f09c90e9e80db436a | kernel.org | Patch |
| https://git.kernel.org/stable/c/ff71709445ac033e6e250d971683110e4781c068 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.15.198, < 5.15.209 >= 5.16, < 6.1.47 >= 6.2, < 6.4.12 6.5 rc1 6.5 rc2 6.5 rc3 6.5 rc4 6.5 rc5 6.5 rc6 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | Modified Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 1, 2026 | CVE Modified | kernel.org |
| Mar 21, 2026 | Reanalysis | [email protected] |
| Feb 12, 2026 | Initial Analysis | [email protected] |
| Oct 4, 2025 | New CVE Received | kernel.org |