CVE-2023-53438 x86/MCE: Always save CS register on AMD Zen IF Poison errors
A flaw in the Linux kernel's AMD Zen MCE handling causes unnecessary kernel panics on data poison errors, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53438?
CVE-2023-53438 is a medium-severity denial of service vulnerability in Linux kernel, published on 18 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/MCE: Always save CS register on AMD Zen IF Poison errors
The Instruction Fetch (IF) units on current AMD Zen-based systems do not guarantee a synchronous #MC is delivered for poison consumption errors. Therefore, MCG_STATUS[EIPV|RIPV] will not be set. However, the microarchitecture does guarantee that the exception is delivered within the same context. In other words, the exact rIP is not known, but the context is known to not have changed.
There is no architecturally-defined method to determine this behavior.
The Code Segment (CS) register is always valid on such IF unit poison errors regardless of the value of MCG_STATUS[EIPV|RIPV].
Add a quirk to save the CS register for poison consumption from the IF unit banks.
This is needed to properly determine the context of the error. Otherwise, the severity grading function will assume the context is IN_KERNEL due to the m->cs value being 0 (the initialized value). This leads to unnecessary kernel panics on data poison errors due to the kernel believing the poison consumption occurred in kernel context.
Which versions are affected by CVE-2023-53438?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53438?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-53438 being exploited?
There is no known exploitation of CVE-2023-53438 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-71924, BELL-CVE-2023-53438, DEBIAN-CVE-2023-53438, GHSA-wqhj-q653-q9c9, ROOT-OS-DEBIAN-11-CVE-2023-53438, ROOT-OS-UBUNTU-2204-CVE-2023-53438 and 1 more.