CVE-2023-53817: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53817 is a null pointer dereference vulnerability in the Linux kernel's crypto: lib/mpi subsystem, specifically in the mpi_cmp_ui() function. During NVMe-over-TCP (NVMeTCP) authentication, a malicious or misbehaving controller can trigger a kernel oops (crash) by specifying the 8192-bit Diffie-Hellman group and passing a correctly sized but fully zeroed Diffie-Hellman public key value. The vulnerability was published on December 9, 2025, and affects the Linux kernel across multiple stable branches. Feedly estimates the severity as Medium, with an EPSS score of approximately 0.046% (Feedly).

The root cause is a null pointer dereference (CWE-476) in mpi_cmp_ui() within the kernel's MPI (Multi-Precision Integer) library. When dh_is_pubkey_valid() calls mpi_cmp_ui() with a second parameter of 1 (rather than 0), the existing zero-value detection logic is bypassed. If the MPI structure's internal data pointer u->d is null — as occurs when a zeroed DH public key is processed — the function proceeds to dereference the null pointer near its end, causing a kernel oops. The attack vector requires network access to an NVMeTCP target, where a controller (initiator) can supply a crafted, zeroed DH value during the authentication handshake (Feedly, Kernel Git).

Successful exploitation causes a kernel oops (panic/crash), resulting in a denial of service on the affected Linux system. The primary impact is availability — an attacker with network access to an NVMeTCP target can remotely crash the host kernel by sending a malformed authentication message. There is no evidence of confidentiality or integrity impact beyond the system crash, and no privilege escalation or code execution has been demonstrated (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2023-53817. The EPSS score is approximately 0.046%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires network-level access to an NVMeTCP target and the ability to act as or impersonate an NVMe controller during the authentication phase (Feedly).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing mpi_cmp_ui, crypto/mpi, or null pointer dereference during NVMeTCP authentication.
• System Behavior: Unexpected system reboots or kernel crashes on hosts running NVMeTCP targets, particularly during authentication handshakes with 8192-bit DH group negotiation.
• Network: Unusual NVMeTCP authentication traffic specifying the 8192-bit Diffie-Hellman group (DHGROUP_8192) with a zeroed public key value from an unexpected or unauthorized initiator.

The Linux kernel maintainers have released fixes across multiple stable branches. Patched versions include 4.14.326, 4.19.295, 5.4.257, 5.10.197, 5.15.133, 6.1.55, 6.5.5, and 6.6+. Users should update to the appropriate patched stable kernel release for their distribution. SUSE has also released kernel security updates addressing this issue (e.g., SUSE-2026-0962-1, SUSE-2026-1041-1, SUSE-2026-20794-1, SUSE-2026-20876-1). As a workaround, restricting network access to NVMeTCP targets or disabling NVMeTCP authentication with the 8192-bit DH group can reduce exposure (Feedly, Kernel Git).