CVE-2023-53340

net/mlx5: Collect command failures data only for known commands

High · published September 17, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Collect command failures data only for known commands

DEVX can issue a general command, which is not used by mlx5 driver.

In case such command is failed, mlx5 is trying to collect the failure

data, However, mlx5 doesn't create a storage for this command, since

mlx5 doesn't use it. This lead to array-index-out-of-bounds error.

Fix it by checking whether the command is known before collecting the

failure data.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.5th percentile
Published
2025-09-17T14:56Z
EPSS history
Timeline
  • 17 SEP 14:56Z
    net/mlx5: Collect command failures data only for known commands
    cvelistv5