CVE-2023-53510

Severity CVSS v4.0:
Pending analysis
Type:
CWE-415 Double Free
Publication date:
01/10/2025
Last modified:
26/01/2026

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: ufs: core: Fix handling of lrbp-&gt;cmd<br /> <br /> ufshcd_queuecommand() may be called two times in a row for a SCSI command<br /> before it is completed. Hence make the following changes:<br /> <br /> - In the functions that submit a command, do not check the old value of<br /> lrbp-&gt;cmd nor clear lrbp-&gt;cmd in error paths.<br /> <br /> - In ufshcd_release_scsi_cmd(), do not clear lrbp-&gt;cmd.<br /> <br /> See also scsi_send_eh_cmnd().<br /> <br /> This commit prevents that the following appears if a command times out:<br /> <br /> WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8<br /> Call trace:<br /> ufshcd_queuecommand+0x6f8/0x9a8<br /> scsi_send_eh_cmnd+0x2c0/0x960<br /> scsi_eh_test_devices+0x100/0x314<br /> scsi_eh_ready_devs+0xd90/0x114c<br /> scsi_error_handler+0x2b4/0xb70<br /> kthread+0x16c/0x1e0

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 3.12 (including) 6.3.13 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.4 (including) 6.4.4 (excluding)