High 7.8Published Oct 1, 2025

CVE-2023-53474x86/MCE/AMD: Use an u64 for bank_map

Updated under an hour ago (Oct 27, 2026, 11:20 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: x86/MCE/AMD: Use an u64 for bank_map Thee maximum number of MCA banks is 64 (MAX_NR_BANKS), see a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64"). However, the bank_map which contains a bitfield of which banks to initialize is of type unsigned int and that overflows when those bit numbers are >= 32, leading to UBSAN complaining correctly: UBSAN: shift-out-of-bounds in arch/x86/kernel/cpu/mce/amd.c:1365:38 shift exponent 32 is too large for 32-bit type 'int' Change the bank_map to a u64 and use the proper BIT_ULL() macro when modifying bits in there. [ bp: Rewrite commit message. ]

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a0bc32b3cacf194dc479b342f006203fd1e1941a before a9b9ea0e63a0ec5e97bf1219ab6dcbd55e362f83; from a0bc32b3cacf194dc479b342f006203fd1e1941a before 11c58a0c1937c157dbdf82d5ab634d68c99f3098; from a0bc32b3cacf194dc479b342f006203fd1e1941a before ba8ffb1251eb629c2ec35220e3896cf4f7b888a7; from a0bc32b3cacf194dc479b342f006203fd1e1941a before 9669fa17287c3af2bbd4868d4c8fdd9e57f8332e; from a0bc32b3cacf194dc479b342f006203fd1e1941a before 67bb7521b6420d81dab7538c0686f18f7d6d09f4; from a0bc32b3cacf194dc479b342f006203fd1e1941a before 4c1cdec319b9aadb65737c3eb1f5cb74bd6aa156	CNA record
linux linux_kernel linux:linux_kernel	from 5.10 before 5.10.180; from 5.11 before 5.15.111; from 5.16 before 6.1.28; from 6.2 before 6.2.15; from 6.3 before 6.3.2	NVD

References

References

https://git.kernel.org/stable/c/a9b9ea0e63a0ec5e97bf1219ab6dcbd55e362f83	patch
https://git.kernel.org/stable/c/11c58a0c1937c157dbdf82d5ab634d68c99f3098	patch
https://git.kernel.org/stable/c/ba8ffb1251eb629c2ec35220e3896cf4f7b888a7	patch
https://git.kernel.org/stable/c/9669fa17287c3af2bbd4868d4c8fdd9e57f8332e	patch
https://git.kernel.org/stable/c/67bb7521b6420d81dab7538c0686f18f7d6d09f4	patch
https://git.kernel.org/stable/c/4c1cdec319b9aadb65737c3eb1f5cb74bd6aa156	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.