Riskcovery

CVE-2023-53680

NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

State
Published
Severity
7.5 High
Published
Oct 7, 2025
Updated
Oct 15, 2026
Reserved
Oct 7, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

OPDESC() simply indexes into nfsd4_ops[] by the op's operation number, without range checking that value. It assumes callers are careful to avoid calling it with an out-of-bounds opnum value.

nfsd4_decode_compound() is not so careful, and can invoke OPDESC() with opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end of nfsd4_ops[].

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f4f9ef4a1b0a1ca80b152e28e176d69515bdf7e8 to before 50827896c365e0f6c8b55ed56d444dafd87c92c5Affected
  • f4f9ef4a1b0a1ca80b152e28e176d69515bdf7e8 to before a64160124d5a078be0c380b1e8a0bad2d040d3a1Affected
  • f4f9ef4a1b0a1ca80b152e28e176d69515bdf7e8 to before ffcbcf087581ae68ddc0a21460f7ecd4315bdd0eAffected
  • f4f9ef4a1b0a1ca80b152e28e176d69515bdf7e8 to before f352c41fa718482979e7e6b71b4da2b718e381ccAffected
  • f4f9ef4a1b0a1ca80b152e28e176d69515bdf7e8 to before 804d8e0a6e54427268790472781e03bc243f4ee3Affected
LinuxLinux
  • 4.14Affected
  • before 4.14Not affected
  • 5.10.220 through 5.10.*Not affected
  • 5.15.107 through 5.15.*Not affected
  • 6.1.24 through 6.1.*Not affected
  • 6.2.11 through 6.2.*Not affected
  • 6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.