---
id: CVE-2023-54168
title: 'RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()

  The ucmd->log_sq_bb_count variable is controlled by the user so this
  shift can wrap.  Fix it by using check_shl…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 <
    3d5ae269c4bd392ec1edbfb3bd031b8f42d7feff
  - >-
    Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 <
    8feca625900777e02a449e53fe4121339934c38a
  - >-
    Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 <
    9ad3221c86cc9c6305594b742d4a72dfbd4ea579
  - >-
    Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 <
    9911be2155720221a4f1f722b22bd0e2388d8bcf
  - >-
    Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 <
    3ce0df3493277b9df275cb8455d9c677ae701230
  - >-
    Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 <
    196a6df08b08699ace4ce70e1efcdd9081b6565f
  - >-
    Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 <
    a183905869e692b6b7805b7472235585eff8e429
  - >-
    Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 <
    d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb
  - Linux 2.6.24
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:38:50.339644Z'
published: '2025-12-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:41:40.726Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-54168'
references:
  - url: 'https://git.kernel.org/stable/c/3d5ae269c4bd392ec1edbfb3bd031b8f42d7feff'
  - url: 'https://git.kernel.org/stable/c/8feca625900777e02a449e53fe4121339934c38a'
  - url: 'https://git.kernel.org/stable/c/9ad3221c86cc9c6305594b742d4a72dfbd4ea579'
  - url: 'https://git.kernel.org/stable/c/9911be2155720221a4f1f722b22bd0e2388d8bcf'
  - url: 'https://git.kernel.org/stable/c/3ce0df3493277b9df275cb8455d9c677ae701230'
  - url: 'https://git.kernel.org/stable/c/196a6df08b08699ace4ce70e1efcdd9081b6565f'
  - url: 'https://git.kernel.org/stable/c/a183905869e692b6b7805b7472235585eff8e429'
  - url: 'https://git.kernel.org/stable/c/d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb'
tags:
  - cve.org
epss: 0.00155
epssPercentile: 0.04185
ingestedAt: '2026-10-15T22:48:25.432Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()

The ucmd->log_sq_bb_count variable is controlled by the user so this
shift can wrap.  Fix it by using check_shl_overflow() in the same way
that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined
behavior in hns_roce_set_user_sq_size()").

## Affected

- `Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 < 3d5ae269c4bd392ec1edbfb3bd031b8f42d7feff`
- `Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 < 8feca625900777e02a449e53fe4121339934c38a`
- `Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 < 9ad3221c86cc9c6305594b742d4a72dfbd4ea579`
- `Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 < 9911be2155720221a4f1f722b22bd0e2388d8bcf`
- `Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 < 3ce0df3493277b9df275cb8455d9c677ae701230`
- `Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 < 196a6df08b08699ace4ce70e1efcdd9081b6565f`
- `Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 < a183905869e692b6b7805b7472235585eff8e429`
- `Linux >= 839041329fd3410e07d614f81e75bb43367d8f89 < d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb`
- `Linux 2.6.24`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.