CVE-2023-53598

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-53598", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-10-04T15:40:38.479Z", "datePublished": "2025-10-04T15:44:10.380Z", "dateUpdated": "2026-10-15T21:41:31.407Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:15:01.826Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: host: Range check CHDBOFF and ERDBOFF\n\nIf the value read from the CHDBOFF and ERDBOFF registers is outside the\nrange of the MHI register space then an invalid address might be computed\nwhich later causes a kernel panic. Range check the read value to prevent\na crash due to bad data from the device."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The malicious input is the CHDBOFF/ERDBOFF MMIO register content supplied by the attached MHI device (PCIe/M.2 WWAN modem, ath11k/ath12k WiFi), so the attack originates from locally-attached hardware or firmware-compromised baseband, not from the network. This matches the kernel CNA precedent for the analogous MHI host bug CVE-2025-39790.\nAC:L - The device has complete and deterministic control over the value it returns for CHDBOFF/ERDBOFF, and mhi_init_mmio() consumes it unconditionally on every power-up; there is no race and no memory-layout condition outside the attacker's control.\nPR:N - No host credentials or user account are needed \u2014 the device attacks the host during driver power-up/reset recovery, and a compromised device can force re-entry into mhi_ready_state_transition() itself via SYS_ERROR/RDDM reset.\nUI:N - No victim action is required; mhi_init_mmio() runs automatically at probe and on every device-initiated reset recovery, and the immediately following mhi_ring_er_db() dereferences the corrupted pointer.\nS:U - The out-of-bounds accesses and resulting corruption occur within the kernel, the same security authority as the vulnerable driver; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The device-chosen 32-bit offset produces an unbounded __iomem pointer that is read back through mhi_debugfs_regdump_show()'s MHI_WAKE_DB entry, and the same primitive can be aimed at other devices' MMIO or vmalloc-region kernel data, giving an unbounded read.\nI:H - mhi_write_db() writes 64-bit doorbell values to base+val where val is fully device-controlled across a 4 GiB range above the ioremap base, an out-of-bounds write that can corrupt adjacent ioremap'd device registers or vmalloc-region kernel memory (which includes module text on arm64).\nA:H - The commit message states directly that the invalid computed address \"later causes a kernel panic\"; writing to an unmapped kernel virtual address from mhi_ring_er_db() oopses the machine, and the device can repeat it on every reset."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bus/mhi/host/init.c"], "versions": [{"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "372f1752b74572b0a9d2288841eab7db17daccae", "status": "affected", "versionType": "git"}, {"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "2343385fe6eed11d0432ab42a97b3ca4aef06a99", "status": "affected", "versionType": "git"}, {"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "a2cbb1a45a0c86ce77839c0875414efe1a89315e", "status": "affected", "versionType": "git"}, {"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "83bf6b87e2dd053d95d89eb2f01ae885f9e568db", "status": "affected", "versionType": "git"}, {"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "4e584127ec2bd42a37c88badb49df409f21fa40a", "status": "affected", "versionType": "git"}, {"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "6a0c637bfee69a74c104468544d9f2a6579626d0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bus/mhi/host/init.c"], "versions": [{"version": "5.7", "status": "affected"}, {"version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.192", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.112", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.28", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.2.15", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.3.2", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.10.192"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.28"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.2.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/372f1752b74572b0a9d2288841eab7db17daccae"}, {"url": "https://git.kernel.org/stable/c/2343385fe6eed11d0432ab42a97b3ca4aef06a99"}, {"url": "https://git.kernel.org/stable/c/a2cbb1a45a0c86ce77839c0875414efe1a89315e"}, {"url": "https://git.kernel.org/stable/c/83bf6b87e2dd053d95d89eb2f01ae885f9e568db"}, {"url": "https://git.kernel.org/stable/c/4e584127ec2bd42a37c88badb49df409f21fa40a"}, {"url": "https://git.kernel.org/stable/c/6a0c637bfee69a74c104468544d9f2a6579626d0"}], "title": "bus: mhi: host: Range check CHDBOFF and ERDBOFF", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-53598", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:35:47.586374Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:31.407Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-53598", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:35:47.586374Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:35:48.187Z"}}], "cna": {"title": "bus: mhi: host: Range check CHDBOFF and ERDBOFF", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The malicious input is the CHDBOFF/ERDBOFF MMIO register content supplied by the attached MHI device (PCIe/M.2 WWAN modem, ath11k/ath12k WiFi), so the attack originates from locally-attached hardware or firmware-compromised baseband, not from the network. This matches the kernel CNA precedent for the analogous MHI host bug CVE-2025-39790.\nAC:L - The device has complete and deterministic control over the value it returns for CHDBOFF/ERDBOFF, and mhi_init_mmio() consumes it unconditionally on every power-up; there is no race and no memory-layout condition outside the attacker's control.\nPR:N - No host credentials or user account are needed \u2014 the device attacks the host during driver power-up/reset recovery, and a compromised device can force re-entry into mhi_ready_state_transition() itself via SYS_ERROR/RDDM reset.\nUI:N - No victim action is required; mhi_init_mmio() runs automatically at probe and on every device-initiated reset recovery, and the immediately following mhi_ring_er_db() dereferences the corrupted pointer.\nS:U - The out-of-bounds accesses and resulting corruption occur within the kernel, the same security authority as the vulnerable driver; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The device-chosen 32-bit offset produces an unbounded __iomem pointer that is read back through mhi_debugfs_regdump_show()'s MHI_WAKE_DB entry, and the same primitive can be aimed at other devices' MMIO or vmalloc-region kernel data, giving an unbounded read.\nI:H - mhi_write_db() writes 64-bit doorbell values to base+val where val is fully device-controlled across a 4 GiB range above the ioremap base, an out-of-bounds write that can corrupt adjacent ioremap'd device registers or vmalloc-region kernel memory (which includes module text on arm64).\nA:H - The commit message states directly that the invalid computed address \"later causes a kernel panic\"; writing to an unmapped kernel virtual address from mhi_ring_er_db() oopses the machine, and the device can repeat it on every reset."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "372f1752b74572b0a9d2288841eab7db17daccae", "versionType": "git"}, {"status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "2343385fe6eed11d0432ab42a97b3ca4aef06a99", "versionType": "git"}, {"status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "a2cbb1a45a0c86ce77839c0875414efe1a89315e", "versionType": "git"}, {"status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "83bf6b87e2dd053d95d89eb2f01ae885f9e568db", "versionType": "git"}, {"status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "4e584127ec2bd42a37c88badb49df409f21fa40a", "versionType": "git"}, {"status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "lessThan": "6a0c637bfee69a74c104468544d9f2a6579626d0", "versionType": "git"}], "programFiles": ["drivers/bus/mhi/host/init.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"status": "unaffected", "version": "0", "lessThan": "5.7", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.192", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.112", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.28", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.2.15", "versionType": "semver", "lessThanOrEqual": "6.2.*"}, {"status": "unaffected", "version": "6.3.2", "versionType": "semver", "lessThanOrEqual": "6.3.*"}, {"status": "unaffected", "version": "6.4", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/bus/mhi/host/init.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/372f1752b74572b0a9d2288841eab7db17daccae"}, {"url": "https://git.kernel.org/stable/c/2343385fe6eed11d0432ab42a97b3ca4aef06a99"}, {"url": "https://git.kernel.org/stable/c/a2cbb1a45a0c86ce77839c0875414efe1a89315e"}, {"url": "https://git.kernel.org/stable/c/83bf6b87e2dd053d95d89eb2f01ae885f9e568db"}, {"url": "https://git.kernel.org/stable/c/4e584127ec2bd42a37c88badb49df409f21fa40a"}, {"url": "https://git.kernel.org/stable/c/6a0c637bfee69a74c104468544d9f2a6579626d0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: host: Range check CHDBOFF and ERDBOFF\n\nIf the value read from the CHDBOFF and ERDBOFF registers is outside the\nrange of the MHI register space then an invalid address might be computed\nwhich later causes a kernel panic. Range check the read value to prevent\na crash due to bad data from the device."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.192", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.112", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.28", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.2.15", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.3.2", "versionStartIncluding": "5.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.4", "versionStartIncluding": "5.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:15:01.826Z"}}}, "cveMetadata": {"cveId": "CVE-2023-53598", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:31.407Z", "dateReserved": "2025-10-04T15:40:38.479Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-04T15:44:10.380Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bus/mhi/host/init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "372f1752b74572b0a9d2288841eab7db17daccae", "status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "versionType": "git"}, {"lessThan": "2343385fe6eed11d0432ab42a97b3ca4aef06a99", "status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "versionType": "git"}, {"lessThan": "a2cbb1a45a0c86ce77839c0875414efe1a89315e", "status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "versionType": "git"}, {"lessThan": "83bf6b87e2dd053d95d89eb2f01ae885f9e568db", "status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "versionType": "git"}, {"lessThan": "4e584127ec2bd42a37c88badb49df409f21fa40a", "status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "versionType": "git"}, {"lessThan": "6a0c637bfee69a74c104468544d9f2a6579626d0", "status": "affected", "version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bus/mhi/host/init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.192", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.112", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.28", "versionType": "semver"}, {"lessThanOrEqual": "6.2.*", "status": "unaffected", "version": "6.2.15", "versionType": "semver"}, {"lessThanOrEqual": "6.3.*", "status": "unaffected", "version": "6.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.4", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CDFCD3A-0AA3-43ED-A57A-F15D2BD10149", "versionEndExcluding": "5.10.192", "versionStartIncluding": "5.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8612AB29-948C-4D53-84D9-6CA2E4A8B015", "versionEndExcluding": "5.15.112", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "08F855F4-7188-4EE1-BD79-D4B6C7E2EF54", "versionEndExcluding": "6.1.28", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3844A90B-940D-46C3-8D7B-9FF63F1AFC2F", "versionEndExcluding": "6.2.15", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "38F6F330-91A0-4675-8B90-6F950471A7CC", "versionEndExcluding": "6.3.2", "versionStartIncluding": "6.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: host: Range check CHDBOFF and ERDBOFF\n\nIf the value read from the CHDBOFF and ERDBOFF registers is outside the\nrange of the MHI register space then an invalid address might be computed\nwhich later causes a kernel panic. Range check the read value to prevent\na crash due to bad data from the device."}], "id": "CVE-2023-53598", "lastModified": "2026-10-15T22:17:43.727", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-53598", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:35:47.586374Z", "version": "2.0.3"}}]}, "published": "2025-10-04T16:15:56.383", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2343385fe6eed11d0432ab42a97b3ca4aef06a99"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/372f1752b74572b0a9d2288841eab7db17daccae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4e584127ec2bd42a37c88badb49df409f21fa40a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6a0c637bfee69a74c104468544d9f2a6579626d0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/83bf6b87e2dd053d95d89eb2f01ae885f9e568db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a2cbb1a45a0c86ce77839c0875414efe1a89315e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bus: mhi: host: Range check CHDBOFF and ERDBOFF", "id": "2401500", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2401500"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbus: mhi: host: Range check CHDBOFF and ERDBOFF\nIf the value read from the CHDBOFF and ERDBOFF registers is outside the\nrange of the MHI register space then an invalid address might be computed\nwhich later causes a kernel panic. Range check the read value to prevent\na crash due to bad data from the device."], "name": "CVE-2023-53598", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:rhivos:1", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat In-Vehicle Operating System 1"}], "public_date": "2025-10-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-53598\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53598\nhttps://lore.kernel.org/linux-cve-announce/2025100429-CVE-2023-53598-cbd8@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-06T14:40:28.962448+00:00", "updated": "2025-10-06T14:40:28.962503+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}