CVE-2023-53238: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53238 is an out-of-bounds memory access vulnerability in the Linux kernel's Hisilicon PHY driver (phy: hisilicon), specifically within the hisi_inno_phy_probe() function. The flaw arises from an incorrect boundary check (> instead of >=) when iterating over the priv->ports[] array, which has a size of INNO_PHY_PORT_NUM, potentially allowing an out-of-bounds write on the final loop iteration. It affects Linux kernel versions from 4.17 through multiple stable branches up to 6.4.x. The vulnerability was published on September 15, 2025, and carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read), though the description also indicates potential for an out-of-bounds write due to the off-by-one error in the loop termination condition. In hisi_inno_phy_probe(), the loop guard uses i > INNO_PHY_PORT_NUM rather than i >= INNO_PHY_PORT_NUM, meaning the loop body executes when i equals INNO_PHY_PORT_NUM — a one-past-the-end index for the priv->ports[] array. This is a local, low-complexity vulnerability requiring low privileges and no user interaction, exploitable by an attacker with local access to a system running an affected kernel on Hisilicon hardware (Red Hat CVE, Feedly).

Successful exploitation could result in memory corruption leading to system instability or kernel crashes (high availability impact), as well as potential unauthorized disclosure of sensitive kernel memory contents (high confidentiality impact). Because the vulnerability resides in a kernel driver, exploitation could affect the entire system rather than a single process. Integrity impact is assessed as none in the CVSS scoring, though memory corruption primitives in kernel space can sometimes be chained for privilege escalation (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation is further constrained by the requirement for local access and the niche hardware (Hisilicon PHY) affected (Red Hat CVE, Feedly).

Patches have been backported to multiple stable Linux kernel branches. Users should upgrade to the following fixed versions or later: 4.19.291, 5.4.253, 5.10.190, 5.15.124, 6.1.43, 6.4.8, or 6.5 (mainline). Vendor-specific patches are also available via Red Hat's Bugzilla and SUSE security advisories. As a general hardening measure, restrict local user access to critical system components and apply vendor security updates promptly (Red Hat CVE, Red Hat Bugzilla, SUSE Advisory).