CVE-2023-52494 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-52494HIGH

Linux Linux — bus: mhi: host: Add alignment check for event ring read pointer

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0028   20.5     —

AFFECTED
  Product  Versions                                    Fixed
  Linux    a1d2bd164c1c78f87968b7883964175ec41c32ae –  —
  Linux    5.13 –                                      5.10.261

TIMELINE
  Feb 20  Reserved by Linux
  Feb 29  Published (CNA: Linux)
  Jul 24  ENRICHED — CVE-2023-52494 (Linux). Received CVSS 7.8 and CPE data from NVD.

CWE-787 · CNA: Linux · CVSS v3.1 · 6 references · NVD status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Add alignment check for event ring read pointer Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
February 20, 2024	Reserved	Reserved by Linux
February 29, 2024	Published	Published (CNA: Linux)
July 24, 2026	ENRICHED	ENRICHED — CVE-2023-52494 (Linux). Received CVSS 7.8 and CPE data from NVD.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Linux	Linux	—	a1d2bd164c1c78f87968b7883964175ec41c32ae	—
Linux	Linux	—	5.13	5.10.261

Weaknesses

CWE-787

References (6)

https://git.kernel.org/stable/c/2df39ac8f813860f79782807c3f7acff40b3c551 [Mailing List, Patch]
https://git.kernel.org/stable/c/76ed0c6f6418cec6efe6f65a0b91f84be80b72eb
https://git.kernel.org/stable/c/94991728c84f8df54fd9eec9b85855ef9057ea08 [Mailing List, Patch]
https://git.kernel.org/stable/c/a9ebfc405fe1be145f414eafadcbf09506082010 [Mailing List, Patch]
https://git.kernel.org/stable/c/ecf8320111822a1ae5d5fc512953eab46d543d0b [Mailing List, Patch]
https://git.kernel.org/stable/c/eff9704f5332a13b08fbdbe0f84059c9e7051d5f [Mailing List, Patch]

Authoritative record: CVE-2023-52494 at cve.org

Vendors: linux

Weaknesses: CWE-787

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-52494 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.