CVE-2023-53347 (GCVE-0-2023-53347)

Vulnerability from cvelistv5 – Published: 2025-09-17 14:56 – Updated: 2026-05-11 19:43
VLAI
Title
net/mlx5: Handle pairing of E-switch via uplink un/load APIs
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Handle pairing of E-switch via uplink un/load APIs In case user switch a device from switchdev mode to legacy mode, mlx5 first unpair the E-switch and afterwards unload the uplink vport. From the other hand, in case user remove or reload a device, mlx5 first unload the uplink vport and afterwards unpair the E-switch. The latter is causing a bug[1], hence, handle pairing of E-switch as part of uplink un/load APIs. [1] In case VF_LAG is used, every tc fdb flow is duplicated to the peer esw. However, the original esw keeps a pointer to this duplicated flow, not the peer esw. e.g.: if user create tc fdb flow over esw0, the flow is duplicated over esw1, in FW/HW, but in SW, esw0 keeps a pointer to the duplicated flow. During module unload while a peer tc fdb flow is still offloaded, in case the first device to be removed is the peer device (esw1 in the example above), the peer net-dev is destroyed, and so the mlx5e_priv is memset to 0. Afterwards, the peer device is trying to unpair himself from the original device (esw0 in the example above). Unpair API invoke the original device to clear peer flow from its eswitch (esw0), but the peer flow, which is stored over the original eswitch (esw0), is trying to use the peer mlx5e_priv, which is memset to 0 and result in bellow kernel-oops. [ 157.964081 ] BUG: unable to handle page fault for address: 000000000002ce60 [ 157.964662 ] #PF: supervisor read access in kernel mode [ 157.965123 ] #PF: error_code(0x0000) - not-present page [ 157.965582 ] PGD 0 P4D 0 [ 157.965866 ] Oops: 0000 [#1] SMP [ 157.967670 ] RIP: 0010:mlx5e_tc_del_fdb_flow+0x48/0x460 [mlx5_core] [ 157.976164 ] Call Trace: [ 157.976437 ] <TASK> [ 157.976690 ] __mlx5e_tc_del_fdb_peer_flow+0xe6/0x100 [mlx5_core] [ 157.977230 ] mlx5e_tc_clean_fdb_peer_flows+0x67/0x90 [mlx5_core] [ 157.977767 ] mlx5_esw_offloads_unpair+0x2d/0x1e0 [mlx5_core] [ 157.984653 ] mlx5_esw_offloads_devcom_event+0xbf/0x130 [mlx5_core] [ 157.985212 ] mlx5_devcom_send_event+0xa3/0xb0 [mlx5_core] [ 157.985714 ] esw_offloads_disable+0x5a/0x110 [mlx5_core] [ 157.986209 ] mlx5_eswitch_disable_locked+0x152/0x170 [mlx5_core] [ 157.986757 ] mlx5_eswitch_disable+0x51/0x80 [mlx5_core] [ 157.987248 ] mlx5_unload+0x2a/0xb0 [mlx5_core] [ 157.987678 ] mlx5_uninit_one+0x5f/0xd0 [mlx5_core] [ 157.988127 ] remove_one+0x64/0xe0 [mlx5_core] [ 157.988549 ] pci_device_remove+0x31/0xa0 [ 157.988933 ] device_release_driver_internal+0x18f/0x1f0 [ 157.989402 ] driver_detach+0x3f/0x80 [ 157.989754 ] bus_remove_driver+0x70/0xf0 [ 157.990129 ] pci_unregister_driver+0x34/0x90 [ 157.990537 ] mlx5_cleanup+0xc/0x1c [mlx5_core] [ 157.990972 ] __x64_sys_delete_module+0x15a/0x250 [ 157.991398 ] ? exit_to_user_mode_prepare+0xea/0x110 [ 157.991840 ] do_syscall_64+0x3d/0x90 [ 157.992198 ] entry_SYSCALL_64_after_hwframe+0x46/0xb0
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d , < b17294e7aa8c39dbb9c3e28e2d1983c88b94b387 (git)
Affected: 04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d , < 10cbfecc0f99f579fb170feee866c9efaab7ee47 (git)
Affected: 04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d , < 2be5bd42a5bba1a05daedc86cf0e248210009669 (git)
Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 6.1.31 , ≤ 6.1.* (semver)
Unaffected: 6.3.5 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53347",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:40:23.871238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:43:02.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch.h",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b17294e7aa8c39dbb9c3e28e2d1983c88b94b387",
              "status": "affected",
              "version": "04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d",
              "versionType": "git"
            },
            {
              "lessThan": "10cbfecc0f99f579fb170feee866c9efaab7ee47",
              "status": "affected",
              "version": "04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d",
              "versionType": "git"
            },
            {
              "lessThan": "2be5bd42a5bba1a05daedc86cf0e248210009669",
              "status": "affected",
              "version": "04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch.h",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.31",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.5",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Handle pairing of E-switch via uplink un/load APIs\n\nIn case user switch a device from switchdev mode to legacy mode, mlx5\nfirst unpair the E-switch and afterwards unload the uplink vport.\nFrom the other hand, in case user remove or reload a device, mlx5\nfirst unload the uplink vport and afterwards unpair the E-switch.\n\nThe latter is causing a bug[1], hence, handle pairing of E-switch as\npart of uplink un/load APIs.\n\n[1]\nIn case VF_LAG is used, every tc fdb flow is duplicated to the peer\nesw. However, the original esw keeps a pointer to this duplicated\nflow, not the peer esw.\ne.g.: if user create tc fdb flow over esw0, the flow is duplicated\nover esw1, in FW/HW, but in SW, esw0 keeps a pointer to the duplicated\nflow.\nDuring module unload while a peer tc fdb flow is still offloaded, in\ncase the first device to be removed is the peer device (esw1 in the\nexample above), the peer net-dev is destroyed, and so the mlx5e_priv\nis memset to 0.\nAfterwards, the peer device is trying to unpair himself from the\noriginal device (esw0 in the example above). Unpair API invoke the\noriginal device to clear peer flow from its eswitch (esw0), but the\npeer flow, which is stored over the original eswitch (esw0), is\ntrying to use the peer mlx5e_priv, which is memset to 0 and result in\nbellow kernel-oops.\n\n[  157.964081 ] BUG: unable to handle page fault for address: 000000000002ce60\n[  157.964662 ] #PF: supervisor read access in kernel mode\n[  157.965123 ] #PF: error_code(0x0000) - not-present page\n[  157.965582 ] PGD 0 P4D 0\n[  157.965866 ] Oops: 0000 [#1] SMP\n[  157.967670 ] RIP: 0010:mlx5e_tc_del_fdb_flow+0x48/0x460 [mlx5_core]\n[  157.976164 ] Call Trace:\n[  157.976437 ]  \u003cTASK\u003e\n[  157.976690 ]  __mlx5e_tc_del_fdb_peer_flow+0xe6/0x100 [mlx5_core]\n[  157.977230 ]  mlx5e_tc_clean_fdb_peer_flows+0x67/0x90 [mlx5_core]\n[  157.977767 ]  mlx5_esw_offloads_unpair+0x2d/0x1e0 [mlx5_core]\n[  157.984653 ]  mlx5_esw_offloads_devcom_event+0xbf/0x130 [mlx5_core]\n[  157.985212 ]  mlx5_devcom_send_event+0xa3/0xb0 [mlx5_core]\n[  157.985714 ]  esw_offloads_disable+0x5a/0x110 [mlx5_core]\n[  157.986209 ]  mlx5_eswitch_disable_locked+0x152/0x170 [mlx5_core]\n[  157.986757 ]  mlx5_eswitch_disable+0x51/0x80 [mlx5_core]\n[  157.987248 ]  mlx5_unload+0x2a/0xb0 [mlx5_core]\n[  157.987678 ]  mlx5_uninit_one+0x5f/0xd0 [mlx5_core]\n[  157.988127 ]  remove_one+0x64/0xe0 [mlx5_core]\n[  157.988549 ]  pci_device_remove+0x31/0xa0\n[  157.988933 ]  device_release_driver_internal+0x18f/0x1f0\n[  157.989402 ]  driver_detach+0x3f/0x80\n[  157.989754 ]  bus_remove_driver+0x70/0xf0\n[  157.990129 ]  pci_unregister_driver+0x34/0x90\n[  157.990537 ]  mlx5_cleanup+0xc/0x1c [mlx5_core]\n[  157.990972 ]  __x64_sys_delete_module+0x15a/0x250\n[  157.991398 ]  ? exit_to_user_mode_prepare+0xea/0x110\n[  157.991840 ]  do_syscall_64+0x3d/0x90\n[  157.992198 ]  entry_SYSCALL_64_after_hwframe+0x46/0xb0"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:43:11.361Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b17294e7aa8c39dbb9c3e28e2d1983c88b94b387"
        },
        {
          "url": "https://git.kernel.org/stable/c/10cbfecc0f99f579fb170feee866c9efaab7ee47"
        },
        {
          "url": "https://git.kernel.org/stable/c/2be5bd42a5bba1a05daedc86cf0e248210009669"
        }
      ],
      "title": "net/mlx5: Handle pairing of E-switch via uplink un/load APIs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53347",
    "datePublished": "2025-09-17T14:56:39.084Z",
    "dateReserved": "2025-09-16T16:08:59.566Z",
    "dateUpdated": "2026-05-11T19:43:11.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53347",
      "date": "2026-07-23",
      "epss": "0.00187",
      "percentile": "0.0855"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53347\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-17T15:15:38.603\",\"lastModified\":\"2026-06-17T06:44:57.767\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Handle pairing of E-switch via uplink un/load APIs\\n\\nIn case user switch a device from switchdev mode to legacy mode, mlx5\\nfirst unpair the E-switch and afterwards unload the uplink vport.\\nFrom the other hand, in case user remove or reload a device, mlx5\\nfirst unload the uplink vport and afterwards unpair the E-switch.\\n\\nThe latter is causing a bug[1], hence, handle pairing of E-switch as\\npart of uplink un/load APIs.\\n\\n[1]\\nIn case VF_LAG is used, every tc fdb flow is duplicated to the peer\\nesw. However, the original esw keeps a pointer to this duplicated\\nflow, not the peer esw.\\ne.g.: if user create tc fdb flow over esw0, the flow is duplicated\\nover esw1, in FW/HW, but in SW, esw0 keeps a pointer to the duplicated\\nflow.\\nDuring module unload while a peer tc fdb flow is still offloaded, in\\ncase the first device to be removed is the peer device (esw1 in the\\nexample above), the peer net-dev is destroyed, and so the mlx5e_priv\\nis memset to 0.\\nAfterwards, the peer device is trying to unpair himself from the\\noriginal device (esw0 in the example above). Unpair API invoke the\\noriginal device to clear peer flow from its eswitch (esw0), but the\\npeer flow, which is stored over the original eswitch (esw0), is\\ntrying to use the peer mlx5e_priv, which is memset to 0 and result in\\nbellow kernel-oops.\\n\\n[  157.964081 ] BUG: unable to handle page fault for address: 000000000002ce60\\n[  157.964662 ] #PF: supervisor read access in kernel mode\\n[  157.965123 ] #PF: error_code(0x0000) - not-present page\\n[  157.965582 ] PGD 0 P4D 0\\n[  157.965866 ] Oops: 0000 [#1] SMP\\n[  157.967670 ] RIP: 0010:mlx5e_tc_del_fdb_flow+0x48/0x460 [mlx5_core]\\n[  157.976164 ] Call Trace:\\n[  157.976437 ]  \u003cTASK\u003e\\n[  157.976690 ]  __mlx5e_tc_del_fdb_peer_flow+0xe6/0x100 [mlx5_core]\\n[  157.977230 ]  mlx5e_tc_clean_fdb_peer_flows+0x67/0x90 [mlx5_core]\\n[  157.977767 ]  mlx5_esw_offloads_unpair+0x2d/0x1e0 [mlx5_core]\\n[  157.984653 ]  mlx5_esw_offloads_devcom_event+0xbf/0x130 [mlx5_core]\\n[  157.985212 ]  mlx5_devcom_send_event+0xa3/0xb0 [mlx5_core]\\n[  157.985714 ]  esw_offloads_disable+0x5a/0x110 [mlx5_core]\\n[  157.986209 ]  mlx5_eswitch_disable_locked+0x152/0x170 [mlx5_core]\\n[  157.986757 ]  mlx5_eswitch_disable+0x51/0x80 [mlx5_core]\\n[  157.987248 ]  mlx5_unload+0x2a/0xb0 [mlx5_core]\\n[  157.987678 ]  mlx5_uninit_one+0x5f/0xd0 [mlx5_core]\\n[  157.988127 ]  remove_one+0x64/0xe0 [mlx5_core]\\n[  157.988549 ]  pci_device_remove+0x31/0xa0\\n[  157.988933 ]  device_release_driver_internal+0x18f/0x1f0\\n[  157.989402 ]  driver_detach+0x3f/0x80\\n[  157.989754 ]  bus_remove_driver+0x70/0xf0\\n[  157.990129 ]  pci_unregister_driver+0x34/0x90\\n[  157.990537 ]  mlx5_cleanup+0xc/0x1c [mlx5_core]\\n[  157.990972 ]  __x64_sys_delete_module+0x15a/0x250\\n[  157.991398 ]  ? exit_to_user_mode_prepare+0xea/0x110\\n[  157.991840 ]  do_syscall_64+0x3d/0x90\\n[  157.992198 ]  entry_SYSCALL_64_after_hwframe+0x46/0xb0\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c\",\"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h\",\"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d\",\"lessThan\":\"b17294e7aa8c39dbb9c3e28e2d1983c88b94b387\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d\",\"lessThan\":\"10cbfecc0f99f579fb170feee866c9efaab7ee47\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d\",\"lessThan\":\"2be5bd42a5bba1a05daedc86cf0e248210009669\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c\",\"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h\",\"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.31\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.5\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T18:40:23.871238Z\",\"id\":\"CVE-2023-53347\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0\",\"versionEndExcluding\":\"6.1.31\",\"matchCriteriaId\":\"4C6D8111-B927-4233-851B-97D7D5770DAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.3.5\",\"matchCriteriaId\":\"34DD94CA-4DA1-41C3-9A9B-92ACD7F4E240\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"38BC6744-7D25-4C02-9966-B224CD071D30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"76061B41-CAE9-4467-BEDE-0FFC7956F2A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A717BA5B-D535-46A0-A329-A25FE5CEC588\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/10cbfecc0f99f579fb170feee866c9efaab7ee47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2be5bd42a5bba1a05daedc86cf0e248210009669\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b17294e7aa8c39dbb9c3e28e2d1983c88b94b387\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T22:19:15+00:00",
      "cve": "CVE-2023-53347",
      "id": "CVE-2023-53347",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5: Handle pairing of E-switch via uplink un/load APIs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53347.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-06-06T04:33:13Z",
      "cve": "CVE-2023-53347",
      "id": "CVE-2023-53347",
      "initial_release_date": "2025-09-17T23:27:51Z",
      "product_status:known_affected": "450",
      "product_status:known_not_affected": "210",
      "product_status:recommended": "87",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53347",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53347.json",
      "version": "16"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-53347\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T18:40:23.871238Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T18:40:19.834Z\"}}], \"cna\": {\"title\": \"net/mlx5: Handle pairing of E-switch via uplink un/load APIs\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d\", \"lessThan\": \"b17294e7aa8c39dbb9c3e28e2d1983c88b94b387\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d\", \"lessThan\": \"10cbfecc0f99f579fb170feee866c9efaab7ee47\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d\", \"lessThan\": \"2be5bd42a5bba1a05daedc86cf0e248210009669\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.3.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.3.*\"}, {\"status\": \"unaffected\", \"version\": \"6.4\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b17294e7aa8c39dbb9c3e28e2d1983c88b94b387\"}, {\"url\": \"https://git.kernel.org/stable/c/10cbfecc0f99f579fb170feee866c9efaab7ee47\"}, {\"url\": \"https://git.kernel.org/stable/c/2be5bd42a5bba1a05daedc86cf0e248210009669\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Handle pairing of E-switch via uplink un/load APIs\\n\\nIn case user switch a device from switchdev mode to legacy mode, mlx5\\nfirst unpair the E-switch and afterwards unload the uplink vport.\\nFrom the other hand, in case user remove or reload a device, mlx5\\nfirst unload the uplink vport and afterwards unpair the E-switch.\\n\\nThe latter is causing a bug[1], hence, handle pairing of E-switch as\\npart of uplink un/load APIs.\\n\\n[1]\\nIn case VF_LAG is used, every tc fdb flow is duplicated to the peer\\nesw. However, the original esw keeps a pointer to this duplicated\\nflow, not the peer esw.\\ne.g.: if user create tc fdb flow over esw0, the flow is duplicated\\nover esw1, in FW/HW, but in SW, esw0 keeps a pointer to the duplicated\\nflow.\\nDuring module unload while a peer tc fdb flow is still offloaded, in\\ncase the first device to be removed is the peer device (esw1 in the\\nexample above), the peer net-dev is destroyed, and so the mlx5e_priv\\nis memset to 0.\\nAfterwards, the peer device is trying to unpair himself from the\\noriginal device (esw0 in the example above). Unpair API invoke the\\noriginal device to clear peer flow from its eswitch (esw0), but the\\npeer flow, which is stored over the original eswitch (esw0), is\\ntrying to use the peer mlx5e_priv, which is memset to 0 and result in\\nbellow kernel-oops.\\n\\n[  157.964081 ] BUG: unable to handle page fault for address: 000000000002ce60\\n[  157.964662 ] #PF: supervisor read access in kernel mode\\n[  157.965123 ] #PF: error_code(0x0000) - not-present page\\n[  157.965582 ] PGD 0 P4D 0\\n[  157.965866 ] Oops: 0000 [#1] SMP\\n[  157.967670 ] RIP: 0010:mlx5e_tc_del_fdb_flow+0x48/0x460 [mlx5_core]\\n[  157.976164 ] Call Trace:\\n[  157.976437 ]  \u003cTASK\u003e\\n[  157.976690 ]  __mlx5e_tc_del_fdb_peer_flow+0xe6/0x100 [mlx5_core]\\n[  157.977230 ]  mlx5e_tc_clean_fdb_peer_flows+0x67/0x90 [mlx5_core]\\n[  157.977767 ]  mlx5_esw_offloads_unpair+0x2d/0x1e0 [mlx5_core]\\n[  157.984653 ]  mlx5_esw_offloads_devcom_event+0xbf/0x130 [mlx5_core]\\n[  157.985212 ]  mlx5_devcom_send_event+0xa3/0xb0 [mlx5_core]\\n[  157.985714 ]  esw_offloads_disable+0x5a/0x110 [mlx5_core]\\n[  157.986209 ]  mlx5_eswitch_disable_locked+0x152/0x170 [mlx5_core]\\n[  157.986757 ]  mlx5_eswitch_disable+0x51/0x80 [mlx5_core]\\n[  157.987248 ]  mlx5_unload+0x2a/0xb0 [mlx5_core]\\n[  157.987678 ]  mlx5_uninit_one+0x5f/0xd0 [mlx5_core]\\n[  157.988127 ]  remove_one+0x64/0xe0 [mlx5_core]\\n[  157.988549 ]  pci_device_remove+0x31/0xa0\\n[  157.988933 ]  device_release_driver_internal+0x18f/0x1f0\\n[  157.989402 ]  driver_detach+0x3f/0x80\\n[  157.989754 ]  bus_remove_driver+0x70/0xf0\\n[  157.990129 ]  pci_unregister_driver+0x34/0x90\\n[  157.990537 ]  mlx5_cleanup+0xc/0x1c [mlx5_core]\\n[  157.990972 ]  __x64_sys_delete_module+0x15a/0x250\\n[  157.991398 ]  ? exit_to_user_mode_prepare+0xea/0x110\\n[  157.991840 ]  do_syscall_64+0x3d/0x90\\n[  157.992198 ]  entry_SYSCALL_64_after_hwframe+0x46/0xb0\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.31\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.3.5\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.4\", \"versionStartIncluding\": \"5.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T19:43:11.361Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-53347\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T19:43:11.361Z\", \"dateReserved\": \"2025-09-16T16:08:59.566Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-17T14:56:39.084Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.