CVE-2023-54154

scsi: target: core: Fix target_cmd_counter leak

State: Published
Severity: Not scored
Published: Dec 24, 2025
Updated: May 23, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: core: Fix target_cmd_counter leak

The target_cmd_counter struct allocated via target_alloc_cmd_counter() is never freed, resulting in leaks across various transport types, e.g.:

unreferenced object 0xffff88801f920120 (size 96): comm "sh", pid 102, jiffies 4294892535 (age 713.412s) hex dump (first 32 bytes): 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 38 01 92 1f 80 88 ff ff ........8....... backtrace: [<00000000e58a6252>] kmalloc_trace+0x11/0x20 [<0000000043af4b2f>] target_alloc_cmd_counter+0x17/0x90 [target_core_mod] [<000000007da2dfa7>] target_setup_session+0x2d/0x140 [target_core_mod] [<0000000068feef86>] tcm_loop_tpg_nexus_store+0x19b/0x350 [tcm_loop] [<000000006a80e021>] configfs_write_iter+0xb1/0x120 [<00000000e9f4d860>] vfs_write+0x2e4/0x3c0 [<000000008143433b>] ksys_write+0x80/0xb0 [<00000000a7df29b2>] do_syscall_64+0x42/0x90 [<0000000053f45fb8>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Free the structure alongside the corresponding iscsit_conn / se_sess parent.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	76b77646f17118f5babe93c032e6b7a53bbde3b9 to before 1cd41d1669bcbc5052afa897f85608a62ff3fb30Affected becd9be6069e7b183c084f460f0eb363e43cc487 to before f84639c5ac5f4f95b3992da1af4ff382ebf2e819Affected becd9be6069e7b183c084f460f0eb363e43cc487 to before d14e3e553e05cb763964c991fe6acb0a6a1c6f9cAffected bc5ebf93ae23a928303b3643c6f4c4da2f769e7cAffected 1eaaf1b828cdaa58abccc68962d24005fd5e8852Affected 6.1.28 to before 6.1.55Affected 6.2.15 to before 6.3Affected 6.3.2 to before 6.4Affected
LinuxLinux	6.4Affected before 6.4Not affected 6.1.55 through 6.1.Not affected 6.5.5 through 6.5.Not affected 6.6 and laterNot affected

Product

Versions

LinuxLinux

76b77646f17118f5babe93c032e6b7a53bbde3b9 to before 1cd41d1669bcbc5052afa897f85608a62ff3fb30Affected
becd9be6069e7b183c084f460f0eb363e43cc487 to before f84639c5ac5f4f95b3992da1af4ff382ebf2e819Affected
becd9be6069e7b183c084f460f0eb363e43cc487 to before d14e3e553e05cb763964c991fe6acb0a6a1c6f9cAffected
bc5ebf93ae23a928303b3643c6f4c4da2f769e7cAffected
1eaaf1b828cdaa58abccc68962d24005fd5e8852Affected
6.1.28 to before 6.1.55Affected
6.2.15 to before 6.3Affected
6.3.2 to before 6.4Affected

LinuxLinux

6.4Affected
before 6.4Not affected
6.1.55 through 6.1.*Not affected
6.5.5 through 6.5.*Not affected
6.6 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.