CVE-2023-53817

Linux Kernel - Denial of Service via Null Pointer Dereference in mpi_cmp_ui

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() During NVMeTCP Authentication a controller can trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a correctly sized, but zeroed Diffie Hellamn value. mpi_cmp_ui() was detecting this if the second parameter was 0, but 1 is passed from dh_is_pubkey_valid(). This causes the null pointer u->d to be dereferenced towards the end of mpi_cmp_ui()

Scores

EPSS 0.0026
EPSS Percentile 17.4%

Details

Status published
Products (25)
linux/Kernel 3.7.0 - 4.14.326linux
linux/Kernel 4.15.0 - 4.19.295linux
linux/Kernel 4.20.0 - 5.4.257linux
linux/Kernel 5.11.0 - 5.15.133linux
linux/Kernel 5.16.0 - 6.1.55linux
linux/Kernel 5.5.0 - 5.10.197linux
linux/Kernel 6.2.0 - 6.5.5linux
Linux/Linux < 3.7
Linux/Linux 12f008b6dc5ff1c822fdb2198d20e3dbdc92f3f5 - 0fc7147c694394f8a8cbc19570c6bc918cac0906
Linux/Linux 12f008b6dc5ff1c822fdb2198d20e3dbdc92f3f5 - 12ac013ad7ff0df066451e825801d805095b3776
... and 15 more
Published Dec 09, 2025
Tracked Since Feb 18, 2026