CVE-2023-53817 crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
A remote attacker can cause a kernel crash by sending a zeroed Diffie-Hellman value during NVMeTCP authentication, leading to a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53817?
CVE-2023-53817 is a high-severity vulnerability in Linux, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
During NVMeTCP Authentication a controller can trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a correctly sized, but zeroed Diffie Hellamn value. mpi_cmp_ui() was detecting this if the second parameter was 0, but 1 is passed from dh_is_pubkey_valid(). This causes the null pointer u->d to be dereferenced towards the end of mpi_cmp_ui()
Which versions are affected by CVE-2023-53817?
How do I fix CVE-2023-53817?
Apply the vendor's patch.
Is CVE-2023-53817 being exploited?
There is no known exploitation of CVE-2023-53817 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-53817, DEBIAN-CVE-2023-53817, GHSA-3w8q-vg6g-cg46, UBUNTU-CVE-2023-53817.