CVE-2023-53322

scsi: qla2xxx: Wait for io return on terminate rport

State: Published
Severity: 8.8 High
Published: Sep 16, 2025
Updated: Aug 5, 2026
Reserved: Sep 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Wait for io return on terminate rport

System crash due to use after free. Current code allows terminate_rport_io to exit before making sure all IOs has returned. For FCP-2 device, IO's can hang on in HW because driver has not tear down the session in FW at first sign of cable pull. When dev_loss_tmo timer pops, terminate_rport_io is called and upper layer is about to free various resources. Terminate_rport_io trigger qla to do the final cleanup, but the cleanup might not be fast enough where it leave qla still holding on to the same resource.

Wait for IO's to return to upper layer before resources are freed.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	715848ca6fffeb6362a50887d9c26245bd5dfba9 to before 8a55556cd7e0220486163b1285ce11a8be2ce5faAffected 715848ca6fffeb6362a50887d9c26245bd5dfba9 to before 4647d2e88918a078359d1532d90c417a38542c9eAffected 715848ca6fffeb6362a50887d9c26245bd5dfba9 to before d25fded78d88e1515439b3ba581684d683e0b6abAffected 715848ca6fffeb6362a50887d9c26245bd5dfba9 to before a9fe97fb7b4ee21bffb76f2acb05769bad27ae70Affected 715848ca6fffeb6362a50887d9c26245bd5dfba9 to before 079c8264ed9fea8cbcac01ad29040f901cbc3692Affected 715848ca6fffeb6362a50887d9c26245bd5dfba9 to before 90770dad1eb30967ebd8d37d82830bcf270b3293Affected 715848ca6fffeb6362a50887d9c26245bd5dfba9 to before 5bcdaafd92be6035ddc77fa76650cf9dd5b864c4Affected 715848ca6fffeb6362a50887d9c26245bd5dfba9 to before fc0cba0c7be8261a1625098bd1d695077ec621c9Affected
LinuxLinux	2.6.34Affected before 2.6.34Not affected 4.14.322 through 4.14.Not affected 4.19.291 through 4.19.Not affected 5.4.251 through 5.4.Not affected 5.10.188 through 5.10.Not affected 5.15.121 through 5.15.Not affected 6.1.40 through 6.1.Not affected 6.4.5 through 6.4.*Not affected 6.5 and laterNot affected

Product

Versions

LinuxLinux

715848ca6fffeb6362a50887d9c26245bd5dfba9 to before 8a55556cd7e0220486163b1285ce11a8be2ce5faAffected
715848ca6fffeb6362a50887d9c26245bd5dfba9 to before 4647d2e88918a078359d1532d90c417a38542c9eAffected
715848ca6fffeb6362a50887d9c26245bd5dfba9 to before d25fded78d88e1515439b3ba581684d683e0b6abAffected
715848ca6fffeb6362a50887d9c26245bd5dfba9 to before a9fe97fb7b4ee21bffb76f2acb05769bad27ae70Affected
715848ca6fffeb6362a50887d9c26245bd5dfba9 to before 079c8264ed9fea8cbcac01ad29040f901cbc3692Affected
715848ca6fffeb6362a50887d9c26245bd5dfba9 to before 90770dad1eb30967ebd8d37d82830bcf270b3293Affected
715848ca6fffeb6362a50887d9c26245bd5dfba9 to before 5bcdaafd92be6035ddc77fa76650cf9dd5b864c4Affected
715848ca6fffeb6362a50887d9c26245bd5dfba9 to before fc0cba0c7be8261a1625098bd1d695077ec621c9Affected

LinuxLinux

2.6.34Affected
before 2.6.34Not affected
4.14.322 through 4.14.*Not affected
4.19.291 through 4.19.*Not affected
5.4.251 through 5.4.*Not affected
5.10.188 through 5.10.*Not affected
5.15.121 through 5.15.*Not affected
6.1.40 through 6.1.*Not affected
6.4.5 through 6.4.*Not affected
6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.