Home

Description

In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: fix out-of-bounds access The probe function sets priv->chip_data to (void *)priv + sizeof(*priv) with the expectation that priv has enough trailing space. However, only realtek-smi actually allocated this chip_data space. Do likewise in realtek-mdio to fix out-of-bounds accesses. These accesses likely went unnoticed so far, because of an (unused) buf[4096] member in struct realtek_priv, which caused kmalloc to round up the allocated buffer to a big enough size, so nothing of value was overwritten. With a different allocator (like in the barebox bootloader port of the driver) or with KASAN, the memory corruption becomes quickly apparent.

PUBLISHED Reserved 2025-12-24 | Published 2025-12-24 | Updated 2025-12-24 | Assigner Linux

Product status

Default status
unaffected

aac94001067da183455d6d37959892744fa01d9d (git) before cc0f9bb99735d2b68fac68f37b585d615728ce5b
affected

aac94001067da183455d6d37959892744fa01d9d (git) before fe668aa499b4b95425044ba11af9609db6ecf466
affected

aac94001067da183455d6d37959892744fa01d9d (git) before b93eb564869321d0dffaf23fcc5c88112ed62466
affected

Default status
affected

5.18
affected

Any version before 5.18
unaffected

6.1.23 (semver)
unaffected

6.2.10 (semver)
unaffected

6.3 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/cc0f9bb99735d2b68fac68f37b585d615728ce5b

git.kernel.org/...c/fe668aa499b4b95425044ba11af9609db6ecf466

git.kernel.org/...c/b93eb564869321d0dffaf23fcc5c88112ed62466

cve.org (CVE-2023-54065)

nvd.nist.gov (CVE-2023-54065)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.