PT-2025-37878 · Linux+4 · Linux Kernel+4

Published 2023-03-06 · Updated 2025-10-23 · CVE-2023-53273

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The relid2channel() function within the vmbus driver makes an assumption about the allocation of the vmbus channel array. Specifically, it assumes the array is allocated when called. However, during scenarios like kdump/kexec, not all relids are reset by the host. If a second kernel boots and a vmbus interrupt occurs during vmbus driver initialization—before vmbus connect() completes or fails—the interrupt service routine calls relid2channel() and may cause a null pointer dereference. The issue results in a warning message and an error within relid2channel() when an invalid channel ID is encountered in the second kernel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

ALSA-2025_16880

BDU:2026-06006

CESA-2023_2951

CVE-2023-53273

RHSA-2023:2458

RHSA-2023:2951

RHSA-2023_2458

RHSA-2023_2951

SUSE-SU-2025:03613-1

SUSE-SU-2025:03615-1

SUSE-SU-2025:03626-1

SUSE-SU-2025:03628-1

SUSE-SU-2025:3716-1

SUSE-SU-2025:3761-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

References · 886

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53273.json · Exploit
• https://git.kernel.org/stable/c/8c3f0ae5435fd20bb1e3a8308488aa6ac33151ee · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53273 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53273 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:03613-1 · Vendor Advisory
• https://git.kernel.org/stable/c/176c6b4889195fbe7016d9401175b48c5c9edf68 · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-53273 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-53273 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53273 · Security Note
• https://git.kernel.org/stable/c/c373e49fbb87aa177819866ed9194ebc5414dfd6 · Patch
• https://git.kernel.org/stable/c/a5c44f3446a0565139b7d8abc78f58b86c398123 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:03615-1 · Vendor Advisory
• https://git.kernel.org/stable/c/1eb65c8687316c65140b48fad27133d583178e15 · Patch
• https://ubuntu.com/security/CVE-2023-53273 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03628-1 · Vendor Advisory