CVE-2023-53398

HIGH EPSS 3.5%
Published Sep 18, 20259mo ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Sep 18, 2025 9mo ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: mlx5: fix possible ptp queue fifo use-after-free Fifo indexes are not checked during pop operations and it leads to potential use-after-free when poping from empty queue. Such case was possible during re-sync action. WARN_ON_ONCE covers future cases. There were out-of-order cqe spotted which lead to drain of the queue and use-after-free because of lack of fifo pointers check. Special check and counter are added to avoid resync operation if SKB could not exist in the fifo because of OOO cqe (skb_id must be between consumer and producer index).

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
3.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 2

VendorProductVersionRange
linuxlinux_kernel*≥6.0  –  <6.1.18
linuxlinux_kernel*≥6.2  –  <6.2.5

References 3

  • git.kernel.org https://git.kernel.org/stable/c/3a50cf1e8e5157b82268eee7e330dbe5736a0948
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/52e6e7a0bc04c85012a9251c7cf2d444a77eb966
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6afdedc4e66e3846ce497744f01b95c34bf39d21
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/3a50cf1e8e5157b82268eee7e330dbe5736a0948
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/52e6e7a0bc04c85012a9251c7cf2d444a77eb966
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6afdedc4e66e3846ce497744f01b95c34bf39d21
    Patch