CVE-2023-53652

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops.

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.22%Up 0.2 points since Oct 8, 2025

What each source reports

NVD Score used7.8

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.

Record: CVE-2023-53652
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

CVE ListNo score

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.

Record: CVE-2023-53652
Updated: 2026-11-02

EUVDEUVD-2025-31952No score

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.

Record: EUVD-2025-31952
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j5px-w2f8-7x3g7.8

In the Linux kernel, the following vulnerability has been resolved: vdpa: Add features attr to...

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.

Record: GHSA-j5px-w2f8-7x3g
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVBELL-CVE-2023-536527.8

Record: BELL-CVE-2023-53652
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-536527.8

In the Linux kernel, the following vulnerability has been resolved: vdpa: Add features attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.

Record: DEBIAN-CVE-2023-53652
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 14 moreShow less

OSVRHSA-2024:23947.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2024:2394
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-536527.8

Record: UBUNTU-CVE-2023-53652
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2026-1773139548No score

kernel: Fix of 78 CVEs

fix: fbdev: fix potential buffer overflow in do_register_framebuffer()
qed: Don't collect too many protection override GRC elements {CVE-2025-39949}
drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693}
pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691}
netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732}
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811}
bpf: Disable preemption in bpf_perf_event_output {CVE-2023-54303}
scsi: target: iscsit: Free cmds before session free {CVE-2023-54184}
fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
memcg: protect concurrent access to mem_cgroup_idr {CVE-2024-43892}
ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
net: tls: avoid hanging tasks on the tx_lock {CVE-2023-54306}
usb: typec: bus: verify partner exists in typec_altmode_attention {CVE-2023-54299}
scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization {CVE-2023-54234}
rxrpc: Fix timeout of a call that hasn't yet been granted a channel {CVE-2023-54195}
block, bfq: Fix division by zero error on zero wsum {CVE-2023-54242}
wifi: cfg80211: reject auth/assoc to AP with our address {CVE-2023-53540}
wifi: iwlwifi: mvm: don't trust firmware n_channels {CVE-2023-53589}
wifi: mac80211: check for station first in client probe {CVE-2023-53588}
bonding: do not assume skb mac_header is set {CVE-2023-53601}
drm/i915: Make intel_get_crtc_new_encoder() less oopsy {CVE-2023-53571}
wifi: rtw88: delete timer and free skb queue when unloading {CVE-2023-53574}
net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
media: uvcvideo: Fix memory leak in uvc_gpio_parse {CVE-2022-50882}
md/raid10: fix memleak of md thread {CVE-2023-54294}
usb: typec: altmodes/displayport: fix pin_assignment_show {CVE-2023-54186}
scsi: qedf: Fix NULL dereference in error handling {CVE-2023-54289}
HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53125}
rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() {CVE-2023-54246}
bpf: Address KCSAN report on bpf_lru_list {CVE-2023-54283}
usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
drm/i915: fix race condition UAF in i915_perf_add_config_ioctl {CVE-2023-54202}
mmc: via-sdmmc: fix return value check of mmc_add_host() {CVE-2022-50846}
bpf: Disable preemption in bpf_event_output {CVE-2023-54173}
net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
net/mlx5: Handle pairing of E-switch via uplink un/load APIs {CVE-2023-53347}
net/mlx5e: Fix cleanup null-ptr deref on encap lock {CVE-2023-53105}
smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
HID: core: ensure __hid_request reserves the report ID as the first byte
HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
HID: intel-ish-hid: Fix kernel panic during warm reset {CVE-2023-53392}
xfs: do not propagate ENODATA…

Record: CLSA-2026-1773139548
Updated: 2026-11-02

OSVNo score

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.

Record: CVE-2023-53652
Updated: 2026-11-02

OSVSUSE-SU-2025:21040-1No score