Riskcovery

CVE-2023-53652

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

State
Published
Severity
Not scored
Published
Oct 7, 2025
Updated
May 11, 2026
Reserved
Oct 7, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops.

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 90fea5a800c3dd80fb8ad9a02929bcef5fde42b8 to before 44b508cc96889e61799cc0fc6c00766a54f3ab5aAffected
  • 90fea5a800c3dd80fb8ad9a02929bcef5fde42b8 to before 645d17e06c502e71b880b2b854930e5a64014640Affected
  • 90fea5a800c3dd80fb8ad9a02929bcef5fde42b8 to before 79c8651587504ba263d2fd67fd4406240fb21f69Affected
LinuxLinux
  • 6.1Affected
  • before 6.1Not affected
  • 6.1.47 through 6.1.*Not affected
  • 6.4.12 through 6.4.*Not affected
  • 6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.