Riskcovery

CVE-2023-53510

scsi: ufs: core: Fix handling of lrbp->cmd

State
Published
Severity
7.8 High
Published
Oct 1, 2025
Updated
Aug 5, 2026
Reserved
Oct 1, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix handling of lrbp->cmd

ufshcd_queuecommand() may be called two times in a row for a SCSI command before it is completed. Hence make the following changes:

- In the functions that submit a command, do not check the old value of lrbp->cmd nor clear lrbp->cmd in error paths.

- In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd.

See also scsi_send_eh_cmnd().

This commit prevents that the following appears if a command times out:

WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8 Call trace: ufshcd_queuecommand+0x6f8/0x9a8 scsi_send_eh_cmnd+0x2c0/0x960 scsi_eh_test_devices+0x100/0x314 scsi_eh_ready_devs+0xd90/0x114c scsi_error_handler+0x2b4/0xb70 kthread+0x16c/0x1e0

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 to before b6d76d63c6d21d5d26c301a46853a2aee72397d5Affected
  • 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 to before f3ee24af62681b942bbd799ac77b90a6d7e1fdb1Affected
  • 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 to before 49234a401e161a2f2698f4612ab792c49b3cad1bAffected
  • 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 to before 549e91a9bbaa0ee480f59357868421a61d369770Affected
LinuxLinux
  • 3.12Affected
  • before 3.12Not affected
  • 6.1.167 through 6.1.*Not affected
  • 6.3.13 through 6.3.*Not affected
  • 6.4.4 through 6.4.*Not affected
  • 6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.