Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash affected systems when mlx5 E-switch pairing is torn down in the wrong order during mode changes, device removal, or reload. The business impact is availability loss on specialized hosts using this networking path, not data theft or remote compromise based on the provided sources.
Executive priority
Schedule remediation through normal kernel patching, with faster handling for network virtualization hosts using mlx5 offloads. This is not evidenced as remotely exploitable or actively exploited, but it can cause service disruption on affected infrastructure.
Technical view
In net/mlx5, VF_LAG peer tc fdb flows can leave software pointers to peer flow state after the peer netdev private data is cleared. During unload/unpair, cleanup can dereference invalid state and trigger a kernel oops. The fix moves E-switch pairing handling into uplink load and unload APIs.
Likely exposure
Exposure appears limited to Linux systems using the mlx5 networking driver with E-switch offloads, VF_LAG, and peer tc fdb flows during switchdev or legacy transitions, device removal, or reload. Generic Linux systems without this driver and configuration are less likely to be exposed.
Exploitation context
The CVSS vector is local, low complexity, low privileges, and high availability impact. The bundle does not cite KEV listing or active exploitation. The described failure path depends on local operational actions and a specific mlx5 offload configuration, so treat it as a targeted denial-of-service risk.
Researcher notes
Key conditions are VF_LAG, duplicated peer tc fdb flows, and teardown ordering during module unload, reload, or mode transition. The provided sources do not include distro-specific fixed versions, proof of exploitation, or broader affected hardware claims beyond the Linux mlx5 path.
Mitigation direction
- Apply Linux kernel or distribution updates containing the referenced stable fixes.
- Check vendor or distribution advisories for exact fixed package versions.
- Prioritize affected hosts using mlx5 E-switch offloads, VF_LAG, or switchdev mode.
- Avoid unnecessary device reloads or mode transitions on exposed hosts until patched.
Validation and detection
- Inventory Linux kernel versions against vendor fixed-version guidance.
- Identify hosts using mlx5_core with E-switch offload or VF_LAG configurations.
- Review crash logs for mlx5e_tc_del_fdb_flow or mlx5_esw_offloads_unpair oops traces.
- Confirm patched kernels include the referenced upstream stable commits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-53347 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b17294e7aa8c39dbb9c3e28e2d1983c88b94b387CVE reference, Linux
- https://git.kernel.org/stable/c/10cbfecc0f99f579fb170feee866c9efaab7ee47CVE reference, Linux
- https://git.kernel.org/stable/c/2be5bd42a5bba1a05daedc86cf0e248210009669CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.