CVE-2023-53817

crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()

HIGH

7.5

CVSS Score

Published: December 9, 2025 at 12:01 AM UTC

Updated: August 5, 2026 at 10:24 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.5%

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() During NVMeTCP Authentication a controller can trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a correctly sized, but zeroed Diffie Hellamn value. mpi_cmp_ui() was detecting this if the second parameter was 0, but 1 is passed from dh_is_pubkey_valid(). This causes the null pointer u->d to be dereferenced towards the end of mpi_cmp_ui()

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

3.7 ≤ v < 4.14.3263.7 ≤ v < 4.19.2953.7 ≤ v < 5.10.1973.7 ≤ v < 5.15.1333.7 ≤ v < 5.4.2573.7 ≤ v < 6.1.553.7 ≤ v < 6.5.53.7 ≤ v < 6.612f008b6dc5ff1c822fdb2198d20e3dbdc92f3f53.7

Vendor states this is fixed in 0fc7147c694394f8a8cbc19570c6bc918cac0906 (fixed)

Vendor states this is fixed in 12ac013ad7ff0df066451e825801d805095b3776 (fixed)

Vendor states this is fixed in 61f5453e9706e99713825594e0c8f9031485fb5f (fixed)

Vendor states this is fixed in 67589d247909043e94d2dd5fb590958e0f99d58d (fixed)

Vendor states this is fixed in 9e47a758b70167c9301d2b44d2569f86c7796f2d (fixed)

Vendor states this is fixed in ae63e84ffda74267bf7277c38415ba38389229a0 (fixed)

Vendor states this is fixed in d3ad023a39f1127dcfd331c562673355dc078650 (fixed)

Vendor states this is fixed in fde791e8a96a64ea7b0ad2440e43586447a209c6 (fixed)

Vendor states this is fixed in 3.7 (unaffected)

Vendor states this is fixed in 4.14.326 (unaffected)

Vendor states this is fixed in 4.19.295 (unaffected)

Vendor states this is fixed in 5.10.197 (unaffected)