{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2023-53702 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2023-53702 is a denial of service vulnerability in Linux, published on 22 Oct 2025."},"fix_prompt":"Check this codebase for CVE-2023-53702 and fix it if it is affected.\n\nWhat it is: CVE-2023-53702 is a denial of service vulnerability in Linux, published on 22 Oct 2025. \nExploitation: There is no known exploitation of CVE-2023-53702 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-53702/ (Markdown: https://insights.sbomify.com/CVE-2023-53702/index.md)","id":"CVE-2023-53702","markdown":"https://insights.sbomify.com/CVE-2023-53702/index.md","name":"CVE-2023-53702","record":{"aliases":["BELL-CVE-2023-53702","DEBIAN-CVE-2023-53702","GHSA-28rv-6x7m-q268","ROOT-OS-UBUNTU-2204-CVE-2023-53702","UBUNTU-CVE-2023-53702"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"unknown","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A missing hardware capability check in the s390 ChaCha20 implementation causes a kernel panic on systems without vector instructions.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/crypto: use vector instructions only if available for ChaCha20\n\nCommit 349d03ffd5f6 (\"crypto: s390 - add crypto library interface for\nChaCha20\") added a library interface to the s390 specific ChaCha20\nimplementation. However no check was added to verify if the required\nfacilities are installed before branching into the assembler code.\n\nIf compiled into the kernel, this will lead to the following crash,\nif vector instructions are not available:\n\ndata exception: 0007 ilc:3 [#1] SMP\nModules linked in:\nCPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc7+ #11\nHardware name: IBM 3931 A01 704 (KVM/Linux)\nKrnl PSW : 0704e00180000000 000000001857277a (chacha20_vx+0x32/0x818)\n           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3\nKrnl GPRS: 0000037f0000000a ffffffffffffff60 000000008184b000 0000000019f5c8e6\n           0000000000000109 0000037fffb13c58 0000037fffb13c78 0000000019bb1780\n           0000037fffb13c58 0000000019f5c8e6 000000008184b000 0000000000000109\n           00000000802d8000 0000000000000109 0000000018571ebc 0000037fffb13718\nKrnl Code: 000000001857276a: c07000b1f80b        larl    %r7,0000000019bb1780\n           0000000018572770: a708000a            lhi     %r0,10\n          #0000000018572774: e78950000c36        vlm     %v24,%v25,0(%r5),0\n          \u003e000000001857277a: e7a060000806        vl      %v26,0(%r6),0\n           0000000018572780: e7bf70004c36        vlm     %v27,%v31,0(%r7),4\n           0000000018572786: e70b00000456        vlr     %v0,%v27\n           000000001857278c: e71800000456        vlr     %v1,%v24\n           0000000018572792: e74b00000456        vlr     %v4,%v27\nCall Trace:\n [\u003c000000001857277a\u003e] chacha20_vx+0x32/0x818\nLast Breaking-Event-Address:\n [\u003c0000000018571eb6\u003e] chacha20_crypt_s390.constprop.0+0x6e/0xd8\n---[ end trace 0000000000000000 ]---\nKernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n\nFix this by adding a missing MACHINE_HAS_VX check.\n\n[agordeev@linux.ibm.com: remove duplicates in commit message]","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"s390/crypto: use vector instructions only if available for ChaCha20","id":"CVE-2023-53702","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2023"},"n_packages":0,"n_references":3,"next":{"headline":"HID: amd_sfh: Fix for shift-out-of-bounds","id":"CVE-2023-53703"},"packages":[],"prev":{"headline":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","id":"CVE-2023-53701"},"products":["Linux"],"published":"2025-10-22","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A missing hardware capability check in the s390 ChaCha20 implementation causes a kernel panic on systems without vector instructions.","url":"https://insights.sbomify.com/CVE-2023-53702/"}