CVE-2023-53543

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-53543
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53543.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-53543
Downstream
Related
Published
2025-10-04T15:16:52Z
Modified
2026-08-12T03:51:46Z
Summary
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
Details

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check

The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops.

That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53543.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
447092100c7e71aa20469a270fcee441d807ed58
Fixed
baed19c108ac8287425b93a44985bbe9a0b1af8d
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ad69dd0bf26b88ec6ab26f8bbe5cd74fbed7672a
Fixed
ff71709445ac033e6e250d971683110e4781c068
Fixed
ea65e8b5e6b1a34deda7564f09c90e9e80db436a
Fixed
5d6ba607d6cb5c58a4ddf33381e18c83dbb4098f
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.15.198
Fixed
5.15.209

Affected versions

v5.*
v5.15.198
v5.15.199
v5.15.200
v5.15.201
v5.15.202
v5.15.203
v5.15.204
v5.15.205
v5.15.206
v5.15.207
v5.15.208

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53543.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.15.209
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.47
Fixed
6.4.12

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53543.json"