CVE-2023-53543

vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check

The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops.

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.17%Up 0.1 points since Oct 5, 2025

What each source reports

NVD Score used 7.8

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.

Record: CVE-2023-53543
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-05

CVE List No score

vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.

Record: CVE-2023-53543
Updated: 2026-11-05

EUVDEUVD-2025-32350 No score

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.

Record: EUVD-2025-32350
Updated: 2026-11-05

GitHub AdvisoriesGHSA-5ww6-4m54-3jr9 7.8

In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to...

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.

Record: GHSA-5ww6-4m54-3jr9
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVBELL-CVE-2023-53543 7.8

Record: BELL-CVE-2023-53543
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-53543 7.8

In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.

Record: DEBIAN-CVE-2023-53543
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

Show 15 moreShow less

OSVUBUNTU-CVE-2023-53543 7.8

Record: UBUNTU-CVE-2023-53543
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-78264 No score

CVE-2023-53543 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.

Record: AZL-78264
Updated: 2026-11-02

OSVCLSA-2026-1786350974 No score

kernel: Fix of 119 CVEs

KVM: x86: Check for invalid/obsolete root after making MMU pages available {CVE-2026-64561}
KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level {CVE-2026-63807}
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak {CVE-2025-40035}
thunderbolt: Limit XDomain response copy to actual frame size {CVE-2026-53146}
drm/gud: Fix UBSAN warning {CVE-2022-50628}
wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests {CVE-2023-54108}
fs: udf: fix OOB read in lengthAllocDescs handling {CVE-2025-40044}
tipc: Fix use-after-free in tipc_mon_reinit_self(). {CVE-2025-40280}
isofs: Fix out of bound access for corrupted isofs image {CVE-2021-47478}
pppoe: drop PFC frames {CVE-2026-53003}
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free {CVE-2026-46304}
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery {CVE-2026-43466}
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails {CVE-2026-45997}
irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions {CVE-2022-49716}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
can: dev: can_set_termination(): allow sleeping GPIOs {CVE-2024-56625}
cxl/mem: Fix shutdown order {CVE-2023-52849}
pinctrl: check the return value of pinmux_ops::get_function_name() {CVE-2025-40030}
usb: usbtmc: Flush anchored URBs in usbtmc_release {CVE-2026-31758}
RDMA/siw: Fix potential NULL pointer dereference in header processing {CVE-2026-23242}
ASoC: wm_adsp: Fix NULL dereference when removing firmware controls {CVE-2026-53350}
net: bcmgenet: fix off-by-one in bcmgenet_put_txcb {CVE-2026-53088}
HID: multitouch: Check to ensure report responses match the request {CVE-2026-43047}
can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23058}
firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle {CVE-2023-53250}
usb: storage: Fix memory leak in USB bulk transport {CVE-2025-68288}
wifi: rtw88: check for PCI upstream bridge existence {CVE-2026-46092}
crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed {CVE-2026-31697}
scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() {CVE-2022-48650}
HID: apple: avoid memory leak in apple_report_fixup() {CVE-2026-31520}
HID: magicmouse: avoid memory leak in magicmouse_report_fixup() {CVE-2026-31522}
scsi: qla2xxx: Avoid fcport pointer dereference {CVE-2023-53603}
RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() {CVE-2026-46178}
scsi: mpi3mr: Add NULL checks when resetting request and reply queues {CVE-2026-43473}
HID: roccat: fix use-after-free in roccat_report_event {CVE-2026-43111}
tap: free page on error paths in tap_get_user_xdp() {CVE-2026-46320}
net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode {CVE-2026-43180}
usb: xhci: Fix memory leak in xhci_disable_slot() {CVE-2026-43432}
PCI: Fix reset_method_store() memory leak {CVE-2024-56745}
rbd: fix null-ptr-deref when device_add_disk() fails {CVE-2026-46079}
net: stmmac: fix integer underflow in chain mode {CVE-2026-31649}
be2net: pass wrb_params in case of OS2BMC {CVE-2025-40264}
thunderbolt: Validate XDomain request packet size before type cast {CVE-2026-53147}
Input: uinput - fix circular locking dependency with ff-core {CVE-2026-31667}
usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency {CVE-2023-52855}
nbd: defer config put in recv_work {CVE-2025-68372}
net: hns3: using the num_tqps in the vf driver to apply for resources {CVE-2025-71064}
serial: imx: fix tx statemachine deadlock {CVE-2023-52456}
bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave() {CVE-2024-47734}
dm-thin: fix metadata refcount underflow {CVE-2026-46107}
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering…

Record: CLSA-2026-1786350974
Updated: 2026-11-02

OSVCLSA-2026-1789141176 No score

kernel: Fix of 131 CVEs

net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
drm/i915: Fix potential UAF in TTM object purge {CVE-2026-63884}
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
Bluetooth: hci_sync: Protect UUID list traversal {CVE-2026-68189}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}
Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
net_sched: red: fix a race in __red_change() {CVE-2025-38108}
iio: event: Fix event FIFO reset race {CVE-2026-64496}
netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123}
media: cx23885: add ioremap return check and cleanup {CVE-2026-68226}
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev {CVE-2026-68176} -…

Record: CLSA-2026-1789141176
Updated: 2026-11-02

OSV No score

vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.

Record: CVE-2023-53543
Updated: 2026-11-07

OSVSUSE-SU-2025:21040-1 No score