CVE-2023-53398 (GCVE-0-2023-53398)

Vulnerability from cvelistv5 – Published: 2025-09-18 13:33 – Updated: 2026-08-05 09:13
VLAI
Title
mlx5: fix possible ptp queue fifo use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: mlx5: fix possible ptp queue fifo use-after-free Fifo indexes are not checked during pop operations and it leads to potential use-after-free when poping from empty queue. Such case was possible during re-sync action. WARN_ON_ONCE covers future cases. There were out-of-order cqe spotted which lead to drain of the queue and use-after-free because of lack of fifo pointers check. Special check and counter are added to avoid resync operation if SKB could not exist in the fifo because of OOO cqe (skb_id must be between consumer and producer index).
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 19:00 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 58a518948f60153e8f6cb8361d2712aa3a1af94a , < 52e6e7a0bc04c85012a9251c7cf2d444a77eb966 (git)
Affected: 58a518948f60153e8f6cb8361d2712aa3a1af94a , < 6afdedc4e66e3846ce497744f01b95c34bf39d21 (git)
Affected: 58a518948f60153e8f6cb8361d2712aa3a1af94a , < 3a50cf1e8e5157b82268eee7e330dbe5736a0948 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.18 , ≤ 6.1.* (semver)
Unaffected: 6.2.5 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53398",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:00:48.835326Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:03:06.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h",
            "drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en_stats.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "52e6e7a0bc04c85012a9251c7cf2d444a77eb966",
              "status": "affected",
              "version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
              "versionType": "git"
            },
            {
              "lessThan": "6afdedc4e66e3846ce497744f01b95c34bf39d21",
              "status": "affected",
              "version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
              "versionType": "git"
            },
            {
              "lessThan": "3a50cf1e8e5157b82268eee7e330dbe5736a0948",
              "status": "affected",
              "version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h",
            "drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
            "drivers/net/ethernet/mellanox/mlx5/core/en_stats.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.18",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlx5: fix possible ptp queue fifo use-after-free\n\nFifo indexes are not checked during pop operations and it leads to\npotential use-after-free when poping from empty queue. Such case was\npossible during re-sync action. WARN_ON_ONCE covers future cases.\n\nThere were out-of-order cqe spotted which lead to drain of the queue and\nuse-after-free because of lack of fifo pointers check. Special check and\ncounter are added to avoid resync operation if SKB could not exist in the\nfifo because of OOO cqe (skb_id must be between consumer and producer\nindex)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in the mlx5 PTP TX port-timestamp completion path (NAPI \u2192 mlx5e_ptp_handle_ts_cqe \u2192 fifo pop), reached only by locally originated skbs with SKBTX_HW_TSTAMP classified as PTP (UDP/319 or ethertype 0x88F7). A remote peer cannot set those TX flags or inject the DMA\u0027d CQEs the handler consumes.\nAC:L - An unprivileged local attacker fully controls the traffic that fills the PTP skb fifo and can burst PTP TX to provoke lost/out-of-order wire CQEs and the subsequent empty-fifo resync drain; the enabling tx_port_ts setting is routine in PTP deployments, not a rare config beyond attacker influence.\nPR:L - setsockopt(SO_TIMESTAMPING) with SOF_TIMESTAMPING_TX_HARDWARE and sending UDP to port 319 need no capabilities, and mlx5e_use_ptpsq() gates only on skb tx_flags and packet type\u2014so any unprivileged local user can drive the vulnerable path once the interface is in normal PTP TX-port-TS configuration.\nUI:N - The attacker\u2019s own packet transmissions and the resulting TS-CQE/NAPI processing trigger the empty-fifo pop and UAF with no action required from another user or administrator.\nS:U - Impact is confined to kernel heap objects (sk_buffs and the driver\u2019s skb fifo) in the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Popping an empty/stale fifo slot yields a use-after-free of sk_buff: mlx5e_skb_cb_get_hwts()/skb_tstamp_tx() read and clone freed slab memory onto a socket error queue, enabling heap disclosure via spraying.\nI:H - The same UAF leads to napi_consume_skb() on a freed (or reallocated) sk_buff, causing double-free/refcount underflow and writes into freed skb-\u003ecb via mlx5e_skb_cb_hwtstamp_handler\u2014heap corruption primitives suitable for control-flow hijack.\nA:H - Empty-fifo pops dereference NULL/stale pointers and double-free sk_buffs in softirq/NAPI context, producing kernel oopses/BUGs (and WARN_ON_ONCE under panic_on_warn) that take down the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:13:53.982Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/52e6e7a0bc04c85012a9251c7cf2d444a77eb966"
        },
        {
          "url": "https://git.kernel.org/stable/c/6afdedc4e66e3846ce497744f01b95c34bf39d21"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a50cf1e8e5157b82268eee7e330dbe5736a0948"
        }
      ],
      "title": "mlx5: fix possible ptp queue fifo use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53398",
    "datePublished": "2025-09-18T13:33:38.842Z",
    "dateReserved": "2025-09-17T14:54:09.738Z",
    "dateUpdated": "2026-08-05T09:13:53.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53398",
      "date": "2026-09-25",
      "epss": "0.00147",
      "percentile": "0.03238"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h",
                  "drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/en_stats.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "52e6e7a0bc04c85012a9251c7cf2d444a77eb966",
                    "status": "affected",
                    "version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6afdedc4e66e3846ce497744f01b95c34bf39d21",
                    "status": "affected",
                    "version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3a50cf1e8e5157b82268eee7e330dbe5736a0948",
                    "status": "affected",
                    "version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h",
                  "drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/en_stats.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.0"
                  },
                  {
                    "lessThan": "6.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BB9BC682-8147-4EF0-972E-449AF070167B",
                    "versionEndExcluding": "6.1.18",
                    "versionStartIncluding": "6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0575B33B-A320-4E51-84CA-10C937341E02",
                    "versionEndExcluding": "6.2.5",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlx5: fix possible ptp queue fifo use-after-free\n\nFifo indexes are not checked during pop operations and it leads to\npotential use-after-free when poping from empty queue. Such case was\npossible during re-sync action. WARN_ON_ONCE covers future cases.\n\nThere were out-of-order cqe spotted which lead to drain of the queue and\nuse-after-free because of lack of fifo pointers check. Special check and\ncounter are added to avoid resync operation if SKB could not exist in the\nfifo because of OOO cqe (skb_id must be between consumer and producer\nindex)."
          }
        ],
        "id": "CVE-2023-53398",
        "lastModified": "2026-06-17T06:45:13.003",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-53398",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:00:48.835326Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-18T14:15:43.050",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3a50cf1e8e5157b82268eee7e330dbe5736a0948"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/52e6e7a0bc04c85012a9251c7cf2d444a77eb966"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6afdedc4e66e3846ce497744f01b95c34bf39d21"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T18:53:01+00:00",
      "cve": "CVE-2023-53398",
      "id": "CVE-2023-53398",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "138",
      "product_status:known_not_affected": "104",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mlx5: fix possible ptp queue fifo use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53398.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:07:46Z",
      "cve": "CVE-2023-53398",
      "id": "CVE-2023-53398",
      "initial_release_date": "2025-09-18T23:38:12Z",
      "product_status:known_affected": "369",
      "product_status:known_not_affected": "456",
      "product_status:recommended": "141",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53398",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53398.json",
      "version": "18"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-53398",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-14T19:00:48.835326Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-14T19:00:44.675Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c",
                "drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h",
                "drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
                "drivers/net/ethernet/mellanox/mlx5/core/en_stats.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "52e6e7a0bc04c85012a9251c7cf2d444a77eb966",
                  "status": "affected",
                  "version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
                  "versionType": "git"
                },
                {
                  "lessThan": "6afdedc4e66e3846ce497744f01b95c34bf39d21",
                  "status": "affected",
                  "version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
                  "versionType": "git"
                },
                {
                  "lessThan": "3a50cf1e8e5157b82268eee7e330dbe5736a0948",
                  "status": "affected",
                  "version": "58a518948f60153e8f6cb8361d2712aa3a1af94a",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c",
                "drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h",
                "drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
                "drivers/net/ethernet/mellanox/mlx5/core/en_stats.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.0"
                },
                {
                  "lessThan": "6.0",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.18",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.2.*",
                  "status": "unaffected",
                  "version": "6.2.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.3",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.18",
                      "versionStartIncluding": "6.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.2.5",
                      "versionStartIncluding": "6.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.3",
                      "versionStartIncluding": "6.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlx5: fix possible ptp queue fifo use-after-free\n\nFifo indexes are not checked during pop operations and it leads to\npotential use-after-free when poping from empty queue. Such case was\npossible during re-sync action. WARN_ON_ONCE covers future cases.\n\nThere were out-of-order cqe spotted which lead to drain of the queue and\nuse-after-free because of lack of fifo pointers check. Special check and\ncounter are added to avoid resync operation if SKB could not exist in the\nfifo because of OOO cqe (skb_id must be between consumer and producer\nindex)."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The UAF is in the mlx5 PTP TX port-timestamp completion path (NAPI \u2192 mlx5e_ptp_handle_ts_cqe \u2192 fifo pop), reached only by locally originated skbs with SKBTX_HW_TSTAMP classified as PTP (UDP/319 or ethertype 0x88F7). A remote peer cannot set those TX flags or inject the DMA\u0027d CQEs the handler consumes.\nAC:L - An unprivileged local attacker fully controls the traffic that fills the PTP skb fifo and can burst PTP TX to provoke lost/out-of-order wire CQEs and the subsequent empty-fifo resync drain; the enabling tx_port_ts setting is routine in PTP deployments, not a rare config beyond attacker influence.\nPR:L - setsockopt(SO_TIMESTAMPING) with SOF_TIMESTAMPING_TX_HARDWARE and sending UDP to port 319 need no capabilities, and mlx5e_use_ptpsq() gates only on skb tx_flags and packet type\u2014so any unprivileged local user can drive the vulnerable path once the interface is in normal PTP TX-port-TS configuration.\nUI:N - The attacker\u2019s own packet transmissions and the resulting TS-CQE/NAPI processing trigger the empty-fifo pop and UAF with no action required from another user or administrator.\nS:U - Impact is confined to kernel heap objects (sk_buffs and the driver\u2019s skb fifo) in the same kernel security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Popping an empty/stale fifo slot yields a use-after-free of sk_buff: mlx5e_skb_cb_get_hwts()/skb_tstamp_tx() read and clone freed slab memory onto a socket error queue, enabling heap disclosure via spraying.\nI:H - The same UAF leads to napi_consume_skb() on a freed (or reallocated) sk_buff, causing double-free/refcount underflow and writes into freed skb-\u003ecb via mlx5e_skb_cb_hwtstamp_handler\u2014heap corruption primitives suitable for control-flow hijack.\nA:H - Empty-fifo pops dereference NULL/stale pointers and double-free sk_buffs in softirq/NAPI context, producing kernel oopses/BUGs (and WARN_ON_ONCE under panic_on_warn) that take down the host."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T09:13:53.982Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/52e6e7a0bc04c85012a9251c7cf2d444a77eb966"
            },
            {
              "url": "https://git.kernel.org/stable/c/6afdedc4e66e3846ce497744f01b95c34bf39d21"
            },
            {
              "url": "https://git.kernel.org/stable/c/3a50cf1e8e5157b82268eee7e330dbe5736a0948"
            }
          ],
          "title": "mlx5: fix possible ptp queue fifo use-after-free",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-53398",
        "datePublished": "2025-09-18T13:33:38.842Z",
        "dateReserved": "2025-09-17T14:54:09.738Z",
        "dateUpdated": "2026-08-05T09:13:53.982Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.