CVE-2023-53729

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-53729", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-10-22T13:21:37.349Z", "datePublished": "2025-10-22T13:23:57.739Z", "dateUpdated": "2026-10-15T21:41:34.911Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:15:43.640Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: qmi_encdec: Restrict string length in decode\n\nThe QMI TLV value for strings in a lot of qmi element info structures\naccount for null terminated strings with MAX_LEN + 1. If a string is\nactually MAX_LEN + 1 length, this will cause an out of bounds access\nwhen the NULL character is appended in decoding."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The decoder is fed by QMI messages arriving on a kernel AF_QIPCRTR socket; an unprivileged local process can create such a socket without any capability check and `sendto()` a local-node port, which `qrtr_local_enqueue()` delivers directly to the in-kernel QMI handle. The alternative source is the modem/WLAN firmware over an on-SoC IPC bus, which is not a network transport either.\nAC:L - Triggering is fully deterministic \u2014 craft a QMI TLV whose string length equals `elem_len` and send it to the handle's port; kernel handles autobind within the 16384-entry ephemeral range 0x4000\u20130x7fff, which is trivially swept or resolved through the QRTR name service. No race, no memory-layout precondition, and no sender check exists in `qmi_handle_message()`.\nPR:L - Only an ordinary local account is needed: `qrtr_create()` enforces no capability, and only binding to a reserved port (unnecessary here) requires CAP_NET_ADMIN. No root, no CAP_NET_ADMIN, and no group membership is required to send to the kernel handle.\nUI:N - The attacker sends the malformed QMI message directly to the always-listening kernel handle; decoding happens in the handle's workqueue with no victim action. No mount, file open, or administrator step is involved.\nS:U - The out-of-bounds write corrupts kernel heap or kernel stack memory within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The off-by-one NUL landing immediately past a slab object is a classic poison-NUL primitive \u2014 zeroing the low byte of an adjacent object's length, index, or pointer field converts into an over-read of neighbouring kernel memory. Consistent with treating exploitable memory corruption as enabling arbitrary read.\nI:H - This is an attacker-triggered out-of-bounds write: a zero byte placed one element past a fixed-size array, reaching past the end of the `kzalloc()`ed decode buffer when the string is the trailing struct member, or past a stack-allocated response struct in the ath10k/ath11k/ath12k transaction path. Heap and stack off-by-one NUL overflows are established stepping stones to control-flow hijack.\nA:H - Corrupting the byte past a slab object or a stack frame can damage allocator/adjacent-object state and panic the kernel, and hardened configurations (KASAN, SLUB redzoning) turn the write into an immediate BUG. The attacker can repeat the send indefinitely with no rate limit."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/soc/qcom/qmi_encdec.c"], "versions": [{"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "6b58859e7c4ac357517a59f0801e8ce1b58a8ee2", "status": "affected", "versionType": "git"}, {"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e", "status": "affected", "versionType": "git"}, {"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "2ccab9f82772ead618689d17dbc6950d6bd1e741", "status": "affected", "versionType": "git"}, {"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "b2f39b813d1eed4a522428d1e6acd7dfe9b81579", "status": "affected", "versionType": "git"}, {"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "f6250ecb7fbb934b89539e7e2ba6c1d8555c0975", "status": "affected", "versionType": "git"}, {"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "22ee7c9c7f381be178b4457bc54530002e08e938", "status": "affected", "versionType": "git"}, {"version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "8d207400fd6b79c92aeb2f33bb79f62dff904ea2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/soc/qcom/qmi_encdec.c"], "versions": [{"version": "4.16", "status": "affected"}, {"version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.295", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.257", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.195", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.132", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.54", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5.4", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "4.19.295"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.4.257"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.10.195"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.15.132"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.1.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.5.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6b58859e7c4ac357517a59f0801e8ce1b58a8ee2"}, {"url": "https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e"}, {"url": "https://git.kernel.org/stable/c/2ccab9f82772ead618689d17dbc6950d6bd1e741"}, {"url": "https://git.kernel.org/stable/c/b2f39b813d1eed4a522428d1e6acd7dfe9b81579"}, {"url": "https://git.kernel.org/stable/c/f6250ecb7fbb934b89539e7e2ba6c1d8555c0975"}, {"url": "https://git.kernel.org/stable/c/22ee7c9c7f381be178b4457bc54530002e08e938"}, {"url": "https://git.kernel.org/stable/c/8d207400fd6b79c92aeb2f33bb79f62dff904ea2"}], "title": "soc: qcom: qmi_encdec: Restrict string length in decode", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-53729", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:36:52.702792Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:34.911Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-53729", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:36:52.702792Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:36:53.176Z"}}], "cna": {"title": "soc: qcom: qmi_encdec: Restrict string length in decode", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The decoder is fed by QMI messages arriving on a kernel AF_QIPCRTR socket; an unprivileged local process can create such a socket without any capability check and `sendto()` a local-node port, which `qrtr_local_enqueue()` delivers directly to the in-kernel QMI handle. The alternative source is the modem/WLAN firmware over an on-SoC IPC bus, which is not a network transport either.\nAC:L - Triggering is fully deterministic \u2014 craft a QMI TLV whose string length equals `elem_len` and send it to the handle's port; kernel handles autobind within the 16384-entry ephemeral range 0x4000\u20130x7fff, which is trivially swept or resolved through the QRTR name service. No race, no memory-layout precondition, and no sender check exists in `qmi_handle_message()`.\nPR:L - Only an ordinary local account is needed: `qrtr_create()` enforces no capability, and only binding to a reserved port (unnecessary here) requires CAP_NET_ADMIN. No root, no CAP_NET_ADMIN, and no group membership is required to send to the kernel handle.\nUI:N - The attacker sends the malformed QMI message directly to the always-listening kernel handle; decoding happens in the handle's workqueue with no victim action. No mount, file open, or administrator step is involved.\nS:U - The out-of-bounds write corrupts kernel heap or kernel stack memory within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The off-by-one NUL landing immediately past a slab object is a classic poison-NUL primitive \u2014 zeroing the low byte of an adjacent object's length, index, or pointer field converts into an over-read of neighbouring kernel memory. Consistent with treating exploitable memory corruption as enabling arbitrary read.\nI:H - This is an attacker-triggered out-of-bounds write: a zero byte placed one element past a fixed-size array, reaching past the end of the `kzalloc()`ed decode buffer when the string is the trailing struct member, or past a stack-allocated response struct in the ath10k/ath11k/ath12k transaction path. Heap and stack off-by-one NUL overflows are established stepping stones to control-flow hijack.\nA:H - Corrupting the byte past a slab object or a stack frame can damage allocator/adjacent-object state and panic the kernel, and hardened configurations (KASAN, SLUB redzoning) turn the write into an immediate BUG. The attacker can repeat the send indefinitely with no rate limit."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "6b58859e7c4ac357517a59f0801e8ce1b58a8ee2", "versionType": "git"}, {"status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e", "versionType": "git"}, {"status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "2ccab9f82772ead618689d17dbc6950d6bd1e741", "versionType": "git"}, {"status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "b2f39b813d1eed4a522428d1e6acd7dfe9b81579", "versionType": "git"}, {"status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "f6250ecb7fbb934b89539e7e2ba6c1d8555c0975", "versionType": "git"}, {"status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "22ee7c9c7f381be178b4457bc54530002e08e938", "versionType": "git"}, {"status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "lessThan": "8d207400fd6b79c92aeb2f33bb79f62dff904ea2", "versionType": "git"}], "programFiles": ["drivers/soc/qcom/qmi_encdec.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"status": "unaffected", "version": "0", "lessThan": "4.16", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.295", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.257", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.195", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.132", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.54", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.5.4", "versionType": "semver", "lessThanOrEqual": "6.5.*"}, {"status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/soc/qcom/qmi_encdec.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6b58859e7c4ac357517a59f0801e8ce1b58a8ee2"}, {"url": "https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e"}, {"url": "https://git.kernel.org/stable/c/2ccab9f82772ead618689d17dbc6950d6bd1e741"}, {"url": "https://git.kernel.org/stable/c/b2f39b813d1eed4a522428d1e6acd7dfe9b81579"}, {"url": "https://git.kernel.org/stable/c/f6250ecb7fbb934b89539e7e2ba6c1d8555c0975"}, {"url": "https://git.kernel.org/stable/c/22ee7c9c7f381be178b4457bc54530002e08e938"}, {"url": "https://git.kernel.org/stable/c/8d207400fd6b79c92aeb2f33bb79f62dff904ea2"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: qmi_encdec: Restrict string length in decode\n\nThe QMI TLV value for strings in a lot of qmi element info structures\naccount for null terminated strings with MAX_LEN + 1. If a string is\nactually MAX_LEN + 1 length, this will cause an out of bounds access\nwhen the NULL character is appended in decoding."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.295", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.257", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.195", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.132", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.54", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.5.4", "versionStartIncluding": "4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6", "versionStartIncluding": "4.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:15:43.640Z"}}}, "cveMetadata": {"cveId": "CVE-2023-53729", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:34.911Z", "dateReserved": "2025-10-22T13:21:37.349Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-22T13:23:57.739Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/soc/qcom/qmi_encdec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6b58859e7c4ac357517a59f0801e8ce1b58a8ee2", "status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "versionType": "git"}, {"lessThan": "64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e", "status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "versionType": "git"}, {"lessThan": "2ccab9f82772ead618689d17dbc6950d6bd1e741", "status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "versionType": "git"}, {"lessThan": "b2f39b813d1eed4a522428d1e6acd7dfe9b81579", "status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "versionType": "git"}, {"lessThan": "f6250ecb7fbb934b89539e7e2ba6c1d8555c0975", "status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "versionType": "git"}, {"lessThan": "22ee7c9c7f381be178b4457bc54530002e08e938", "status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "versionType": "git"}, {"lessThan": "8d207400fd6b79c92aeb2f33bb79f62dff904ea2", "status": "affected", "version": "9b8a11e82615274d4133aab3cf5aa1c59191f0a2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/soc/qcom/qmi_encdec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"lessThan": "4.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.295", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.257", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.195", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.132", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.54", "versionType": "semver"}, {"lessThanOrEqual": "6.5.*", "status": "unaffected", "version": "6.5.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: qmi_encdec: Restrict string length in decode\n\nThe QMI TLV value for strings in a lot of qmi element info structures\naccount for null terminated strings with MAX_LEN + 1. If a string is\nactually MAX_LEN + 1 length, this will cause an out of bounds access\nwhen the NULL character is appended in decoding."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsoc: qcom: qmi_encdec: Restringir la longitud de la cadena en la decodificaci\u00f3n\n\nEl valor TLV de QMI para cadenas en muchas estructuras de informaci\u00f3n de elementos qmi tienen en cuenta cadenas terminadas en nulo con MAX_LEN + 1. Si una cadena tiene realmente una longitud de MAX_LEN + 1, esto causar\u00e1 un acceso fuera de l\u00edmites cuando el car\u00e1cter NULO sea a\u00f1adido en la decodificaci\u00f3n."}], "id": "CVE-2023-53729", "lastModified": "2026-10-28T19:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-53729", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:36:52.702792Z", "version": "2.0.3"}}]}, "published": "2025-10-22T14:15:48.193", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/22ee7c9c7f381be178b4457bc54530002e08e938"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2ccab9f82772ead618689d17dbc6950d6bd1e741"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b58859e7c4ac357517a59f0801e8ce1b58a8ee2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d207400fd6b79c92aeb2f33bb79f62dff904ea2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b2f39b813d1eed4a522428d1e6acd7dfe9b81579"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f6250ecb7fbb934b89539e7e2ba6c1d8555c0975"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: soc: qcom: qmi_encdec: Restrict string length in decode", "id": "2405775", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2405775"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2023-53729", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-53729\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-53729\nhttps://lore.kernel.org/linux-cve-announce/2025102216-CVE-2023-53729-ef1a@gregkh/T"], "threat_severity": "Important"}

{"created": "2025-10-23T10:04:28.583796+00:00", "updated": "2025-10-23T10:04:28.583821+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}