---
id: CVE-2023-53680
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

  OPDESC() simply indexes into nfsd4_ops[] by the op's operation
  number, without range checking that value
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

  OPDESC() simply indexes into nfsd4_ops[] by the op's operation
  number, without range checking that value. It…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-787
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.14, < 5.10.220'
  - 'linux_kernel >= 5.11, < 5.15.107'
  - 'linux_kernel >= 5.16, < 6.1.24'
  - 'linux_kernel >= 6.2, < 6.2.11'
  - linux_kernel = 6.3
patched:
  - linux_kernel 6.2.11
published: '2025-10-07'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:46.337'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-53680'
references:
  - url: 'https://git.kernel.org/stable/c/50827896c365e0f6c8b55ed56d444dafd87c92c5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/804d8e0a6e54427268790472781e03bc243f4ee3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a64160124d5a078be0c380b1e8a0bad2d040d3a1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f352c41fa718482979e7e6b71b4da2b718e381cc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ffcbcf087581ae68ddc0a21460f7ecd4315bdd0e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00305
epssPercentile: 0.23158
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:36:29.078436Z'
ingestedAt: '2026-10-15T22:48:25.416Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

OPDESC() simply indexes into nfsd4_ops[] by the op's operation
number, without range checking that value. It assumes callers are
careful to avoid calling it with an out-of-bounds opnum value.

nfsd4_decode_compound() is not so careful, and can invoke OPDESC()
with opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end
of nfsd4_ops[].

## Affected

- `linux_kernel >= 4.14, < 5.10.220`
- `linux_kernel >= 5.11, < 5.15.107`
- `linux_kernel >= 5.16, < 6.1.24`
- `linux_kernel >= 6.2, < 6.2.11`
- `linux_kernel = 6.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.2.11`