CVE-2023-53632 is a vulnerability in the Linux kernel's mlx5e network driver, specifically concerning the handling of XDP features. It arises when the xdp_set_features() function is called on a registered network device without holding the necessary RTNL lock, which can trigger netdev notifiers and lead to an assertion failure. This issue primarily affects Linux kernel versions where the mlx5e driver is in use. The vulnerability has a CVSS score of 5.5 (Medium), indicating a local attack vector with low complexity, requiring local privileges. The potential impact is a high availability loss, as demonstrated by the assertion failure and system crash observed in the provided call trace. There is no confidentiality or integrity impact. Currently, there is no evidence of active exploitation, nor is exploit code publicly available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention from the broader security community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.3.1, < 6.4.11CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
6.3CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.3:-:*:*:*:*:*:* | ||
6.3CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:* | ||
6.3CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.3:rc4:*:*:*:*:*:* | ||
6.3CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.3:rc5:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.