CVE-2023-54168

RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()

State: Published
Severity: 7.8 High
Published: Dec 30, 2025
Updated: Oct 15, 2026
Reserved: Dec 30, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()

The ucmd->log_sq_bb_count variable is controlled by the user so this shift can wrap. Fix it by using check_shl_overflow() in the same way that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()").

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	839041329fd3410e07d614f81e75bb43367d8f89 to before 3d5ae269c4bd392ec1edbfb3bd031b8f42d7feffAffected 839041329fd3410e07d614f81e75bb43367d8f89 to before 8feca625900777e02a449e53fe4121339934c38aAffected 839041329fd3410e07d614f81e75bb43367d8f89 to before 9ad3221c86cc9c6305594b742d4a72dfbd4ea579Affected 839041329fd3410e07d614f81e75bb43367d8f89 to before 9911be2155720221a4f1f722b22bd0e2388d8bcfAffected 839041329fd3410e07d614f81e75bb43367d8f89 to before 3ce0df3493277b9df275cb8455d9c677ae701230Affected 839041329fd3410e07d614f81e75bb43367d8f89 to before 196a6df08b08699ace4ce70e1efcdd9081b6565fAffected 839041329fd3410e07d614f81e75bb43367d8f89 to before a183905869e692b6b7805b7472235585eff8e429Affected 839041329fd3410e07d614f81e75bb43367d8f89 to before d50b3c73f1ac20dabc53dc6e9d64ce9c79a331ebAffected
LinuxLinux	2.6.24Affected before 2.6.24Not affected 4.19.283 through 4.19.Not affected 5.4.243 through 5.4.Not affected 5.10.180 through 5.10.Not affected 5.15.111 through 5.15.Not affected 6.1.28 through 6.1.Not affected 6.2.15 through 6.2.Not affected 6.3.2 through 6.3.*Not affected 6.4 and laterNot affected

Product

Versions

LinuxLinux

839041329fd3410e07d614f81e75bb43367d8f89 to before 3d5ae269c4bd392ec1edbfb3bd031b8f42d7feffAffected
839041329fd3410e07d614f81e75bb43367d8f89 to before 8feca625900777e02a449e53fe4121339934c38aAffected
839041329fd3410e07d614f81e75bb43367d8f89 to before 9ad3221c86cc9c6305594b742d4a72dfbd4ea579Affected
839041329fd3410e07d614f81e75bb43367d8f89 to before 9911be2155720221a4f1f722b22bd0e2388d8bcfAffected
839041329fd3410e07d614f81e75bb43367d8f89 to before 3ce0df3493277b9df275cb8455d9c677ae701230Affected
839041329fd3410e07d614f81e75bb43367d8f89 to before 196a6df08b08699ace4ce70e1efcdd9081b6565fAffected
839041329fd3410e07d614f81e75bb43367d8f89 to before a183905869e692b6b7805b7472235585eff8e429Affected
839041329fd3410e07d614f81e75bb43367d8f89 to before d50b3c73f1ac20dabc53dc6e9d64ce9c79a331ebAffected

LinuxLinux

2.6.24Affected
before 2.6.24Not affected
4.19.283 through 4.19.*Not affected
5.4.243 through 5.4.*Not affected
5.10.180 through 5.10.*Not affected
5.15.111 through 5.15.*Not affected
6.1.28 through 6.1.*Not affected
6.2.15 through 6.2.*Not affected
6.3.2 through 6.3.*Not affected
6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.