CVE-2023-53340 net/mlx5: Collect command failures data only for known commands
A missing check in the Linux kernel mlx5 driver causes an out-of-bounds error when handling unknown DEVX commands, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53340?
CVE-2023-53340 is a high-severity vulnerability in Linux kernel, published on 17 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Collect command failures data only for known commands
DEVX can issue a general command, which is not used by mlx5 driver. In case such command is failed, mlx5 is trying to collect the failure data, However, mlx5 doesn't create a storage for this command, since mlx5 doesn't use it. This lead to array-index-out-of-bounds error.
Fix it by checking whether the command is known before collecting the failure data.
Weakness: CWE-129
Which versions are affected by CVE-2023-53340?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53340?
Apply the vendor's patch.
Is CVE-2023-53340 being exploited?
There is no known exploitation of CVE-2023-53340 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53340, DEBIAN-CVE-2023-53340, GHSA-cx33-4cq6-86x6, UBUNTU-CVE-2023-53340.