CVE-2023-53078

scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()

State: Published
Severity: Not scored
Published: May 2, 2025
Updated: May 23, 2026
Reserved: May 2, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()

If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak:

unreferenced object 0xffff88810b2c6980 (size 32): comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. backtrace: [<0000000098f3a26d>] alua_activate+0xb0/0x320 [<000000003b529641>] scsi_dh_activate+0xb2/0x140 [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath] [<000000007adc9ace>] process_one_work+0x3c5/0x730 [<00000000c457a985>] worker_thread+0x93/0x650 [<00000000cb80e628>] kthread+0x1ba/0x210 [<00000000a1e61077>] ret_from_fork+0x22/0x30

Fix the problem by freeing 'qdata' in error path.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before 123483df146492ca22b503ae6dacc2ce7c3a3974Affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before c110051d335ef7f62ad33474b0c23997fee5bfb5Affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before 5c4d71424df34fc23dc5336d09394ce68c849542Affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8Affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before 9311e7a554dffd3823499e309a8b86a5cd1540e5Affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before 1c55982beb80c7d3c30278fc6cfda8496a31dbe6Affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before 0d89254a4320eb7de0970c478172f764125c6355Affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before a13faca032acbf2699293587085293bdfaafc8aeAffected 68b275b7cbf065a8ea9b964cbb7d78d2b63c635fAffected 2b1725d1df362499f6bbd5a7e245a4090b29c2bbAffected 4.9.21 to before 4.10Affected 4.10.9 to before 4.11Affected
LinuxLinux	4.11Affected before 4.11Not affected 4.14.312 through 4.14.Not affected 4.19.280 through 4.19.Not affected 5.4.240 through 5.4.Not affected 5.10.177 through 5.10.Not affected 5.15.105 through 5.15.Not affected 6.1.22 through 6.1.Not affected 6.2.9 through 6.2.*Not affected 6.3 and laterNot affected

Product

Versions

LinuxLinux

625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before 123483df146492ca22b503ae6dacc2ce7c3a3974Affected
625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before c110051d335ef7f62ad33474b0c23997fee5bfb5Affected
625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before 5c4d71424df34fc23dc5336d09394ce68c849542Affected
625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8Affected
625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before 9311e7a554dffd3823499e309a8b86a5cd1540e5Affected
625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before 1c55982beb80c7d3c30278fc6cfda8496a31dbe6Affected
625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before 0d89254a4320eb7de0970c478172f764125c6355Affected
625fe857e4fac6518716f3c0ff5e5deb8ec6d238 to before a13faca032acbf2699293587085293bdfaafc8aeAffected
68b275b7cbf065a8ea9b964cbb7d78d2b63c635fAffected
2b1725d1df362499f6bbd5a7e245a4090b29c2bbAffected
4.9.21 to before 4.10Affected
4.10.9 to before 4.11Affected

LinuxLinux

4.11Affected
before 4.11Not affected
4.14.312 through 4.14.*Not affected
4.19.280 through 4.19.*Not affected
5.4.240 through 5.4.*Not affected
5.10.177 through 5.10.*Not affected
5.15.105 through 5.15.*Not affected
6.1.22 through 6.1.*Not affected
6.2.9 through 6.2.*Not affected
6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.