CVE-2023-52606

powerpc/lib: Validate size for vector operations

State: Published
Severity: 7.8 High
Published: Mar 6, 2024
Updated: Aug 5, 2026
Reserved: Mar 2, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/lib: Validate size for vector operations

Some of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. The size of those operations however is determined separately in analyse_instr().

Add a check to validate the assumption on the maximum size of the operations, so as to prevent any unintended kernel stack corruption.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before 42084a428a139f1a429f597d44621e3a18f3e414Affected c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before 0580f4403ad33f379eef865c2a6fe94de37febdfAffected c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before beee482cc4c9a6b1dcffb2e190b4fd8782258678Affected c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before de4f5ed63b8a199704d8cdcbf810309d7eb4b36bAffected c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before abd26515d4b767ba48241eea77b28ce0872aef3eAffected c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before 28b8ba8eebf26f66d9f2df4ba550b6b3b136082cAffected c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before 848e1d7fd710900397e1d0e7584680c1c04e3afdAffected c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59Affected
LinuxLinux	4.14Affected before 4.14Not affected 4.19.307 through 4.19.Not affected 5.4.269 through 5.4.Not affected 5.10.210 through 5.10.Not affected 5.15.149 through 5.15.Not affected 6.1.77 through 6.1.Not affected 6.6.16 through 6.6.Not affected 6.7.4 through 6.7.*Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before 42084a428a139f1a429f597d44621e3a18f3e414Affected
c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before 0580f4403ad33f379eef865c2a6fe94de37febdfAffected
c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before beee482cc4c9a6b1dcffb2e190b4fd8782258678Affected
c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before de4f5ed63b8a199704d8cdcbf810309d7eb4b36bAffected
c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before abd26515d4b767ba48241eea77b28ce0872aef3eAffected
c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before 28b8ba8eebf26f66d9f2df4ba550b6b3b136082cAffected
c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before 848e1d7fd710900397e1d0e7584680c1c04e3afdAffected
c22435a5f3d8f85ea162ae523a6ba60a58521ba5 to before 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59Affected

LinuxLinux

4.14Affected
before 4.14Not affected
4.19.307 through 4.19.*Not affected
5.4.269 through 5.4.*Not affected
5.10.210 through 5.10.*Not affected
5.15.149 through 5.15.*Not affected
6.1.77 through 6.1.*Not affected
6.6.16 through 6.6.*Not affected
6.7.4 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.