Riskcovery

CVE-2023-54234

scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization

State
Published
Severity
7.8 High
Published
Dec 30, 2025
Updated
Oct 15, 2026
Reserved
Dec 30, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization

Commit c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") introduced an array mrioc->evtack_cmds but initialization of the array elements was missed. They are just zero cleared. The function mpi3mr_complete_evt_ack() refers host_tag field of the elements. Due to the zero value of the host_tag field, the function calls clear_bit() for mrico->evtack_cmds_bitmap with wrong bit index. This results in memory access to invalid address and "BUG: KASAN: use-after-free". This BUG was observed at eHBA-9600 firmware update to version 8.3.1.0. To fix it, add the missing initialization of mrioc->evtack_cmds.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c1af985d27da2d530c22604644e9025810f57d7c to before 4e0dfdb48a824deac3dfbc67fb856ef2aee13529Affected
  • c1af985d27da2d530c22604644e9025810f57d7c to before 67989091e11a974003ddf2ec39bc613df8eadd83Affected
  • c1af985d27da2d530c22604644e9025810f57d7c to before e39ea831ebad4ab15c4748cb62a397a8abcca36eAffected
LinuxLinux
  • 5.17Affected
  • before 5.17Not affected
  • 6.1.16 through 6.1.*Not affected
  • 6.2.3 through 6.2.*Not affected
  • 6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.