CVE-2023-53340

net/mlx5: Collect command failures data only for known commands

State: Published
Severity: 7.8 High
Published: Sep 17, 2025
Updated: Aug 5, 2026
Reserved: Sep 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Collect command failures data only for known commands

DEVX can issue a general command, which is not used by mlx5 driver. In case such command is failed, mlx5 is trying to collect the failure data, However, mlx5 doesn't create a storage for this command, since mlx5 doesn't use it. This lead to array-index-out-of-bounds error.

Fix it by checking whether the command is known before collecting the failure data.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-129 Improper Validation of Array Index

Affected Products

Product	Versions
LinuxLinux	34f46ae0d4b38e83cfb26fb6f06b5b5efea47fdc to before 411e4d6caa7f7169192b8dacc8421ac4fd64a354Affected 34f46ae0d4b38e83cfb26fb6f06b5b5efea47fdc to before d8b6f175235d7327b4e1b13216859e89496dfbd5Affected 34f46ae0d4b38e83cfb26fb6f06b5b5efea47fdc to before 2a0a935fb64ee8af253b9c6133bb6702fb152ac2Affected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.31 through 6.1.Not affected 6.3.5 through 6.3.Not affected 6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.