CVE-2023-53493 accel/qaic: tighten bounds checking in decode_message()
An integer overflow in the Linux kernel's QAIC driver allows memory corruption, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53493?
CVE-2023-53493 is a high-severity vulnerability in Linux kernel, published on 1 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
accel/qaic: tighten bounds checking in decode_message()
Copy the bounds checking from encode_message() to decode_message().
This patch addresses the following concerns. Ensure that there is enough space for at least one header so that we don't have a negative size later.
if (msg_hdr_len < sizeof(*trans_hdr))
Ensure that we have enough space to read the next header from the msg->data.
if (msg_len > msg_hdr_len - sizeof(*trans_hdr)) return -EINVAL;
Check that the trans_hdr->len is not below the minimum size:
if (hdr_len < sizeof(*trans_hdr))
This minimum check ensures that we don't corrupt memory in decode_passthrough() when we do.
memcpy(out_trans->data, in_trans->data, len - sizeof(in_trans->hdr));
And finally, use size_add() to prevent an integer overflow:
if (size_add(msg_len, hdr_len) > msg_hdr_len)
Which versions are affected by CVE-2023-53493?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53493?
Apply the vendor's patch.
Is CVE-2023-53493 being exploited?
There is no known exploitation of CVE-2023-53493 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53493, DEBIAN-CVE-2023-53493, GHSA-2fq9-3mp7-xw7v, UBUNTU-CVE-2023-53493.