Riskcovery

CVE-2023-53609

scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed"

State
Published
Severity
7.8 High
Published
Oct 4, 2025
Updated
Oct 15, 2026
Reserved
Oct 4, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed"

The "atomic_inc(&cmd->device->iorequest_cnt)" in scsi_queue_rq() would cause kernel panic because cmd->device may be freed after returning from scsi_dispatch_cmd().

This reverts commit cfee29ffb45b1c9798011b19d454637d1b0fe87d.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • cfee29ffb45b1c9798011b19d454637d1b0fe87d to before 35fe6fa57b994e7da222893adf0bb748d6055e73Affected
  • cfee29ffb45b1c9798011b19d454637d1b0fe87d to before 6ca9818d1624e136a76ae8faedb6b6c95ca66903Affected
LinuxLinux
  • 6.2Affected
  • before 6.2Not affected
  • 6.3.4 through 6.3.*Not affected
  • 6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.