CVE-2023-53654
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
07/10/2025
Last modified:
03/02/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
octeontx2-af: Add validation before accessing cgx and lmac<br />
<br />
with the addition of new MAC blocks like CN10K RPM and CN10KB<br />
RPM_USX, LMACs are noncontiguous and CGX blocks are also<br />
noncontiguous. But during RVU driver initialization, the driver<br />
is assuming they are contiguous and trying to access<br />
cgx or lmac with their id which is resulting in kernel panic.<br />
<br />
This patch fixes the issue by adding proper checks.<br />
<br />
[ 23.219150] pc : cgx_lmac_read+0x38/0x70<br />
[ 23.219154] lr : rvu_program_channels+0x3f0/0x498<br />
[ 23.223852] sp : ffff000100d6fc80<br />
[ 23.227158] x29: ffff000100d6fc80 x28: ffff00010009f880 x27:<br />
000000000000005a<br />
[ 23.234288] x26: ffff000102586768 x25: 0000000000002500 x24:<br />
fffffffffff0f000
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.12 (including) | 5.15.121 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.1.39 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.4.4 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



