CVE-2023-53322 (GCVE-0-2023-53322)

Vulnerability from cvelistv5 – Published: 2025-09-16 16:11 – Updated: 2026-08-05 09:13
VLAI
Title
scsi: qla2xxx: Wait for io return on terminate rport
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Wait for io return on terminate rport System crash due to use after free. Current code allows terminate_rport_io to exit before making sure all IOs has returned. For FCP-2 device, IO's can hang on in HW because driver has not tear down the session in FW at first sign of cable pull. When dev_loss_tmo timer pops, terminate_rport_io is called and upper layer is about to free various resources. Terminate_rport_io trigger qla to do the final cleanup, but the cleanup might not be fast enough where it leave qla still holding on to the same resource. Wait for IO's to return to upper layer before resources are freed.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 715848ca6fffeb6362a50887d9c26245bd5dfba9 , < 8a55556cd7e0220486163b1285ce11a8be2ce5fa (git)
Affected: 715848ca6fffeb6362a50887d9c26245bd5dfba9 , < 4647d2e88918a078359d1532d90c417a38542c9e (git)
Affected: 715848ca6fffeb6362a50887d9c26245bd5dfba9 , < d25fded78d88e1515439b3ba581684d683e0b6ab (git)
Affected: 715848ca6fffeb6362a50887d9c26245bd5dfba9 , < a9fe97fb7b4ee21bffb76f2acb05769bad27ae70 (git)
Affected: 715848ca6fffeb6362a50887d9c26245bd5dfba9 , < 079c8264ed9fea8cbcac01ad29040f901cbc3692 (git)
Affected: 715848ca6fffeb6362a50887d9c26245bd5dfba9 , < 90770dad1eb30967ebd8d37d82830bcf270b3293 (git)
Affected: 715848ca6fffeb6362a50887d9c26245bd5dfba9 , < 5bcdaafd92be6035ddc77fa76650cf9dd5b864c4 (git)
Affected: 715848ca6fffeb6362a50887d9c26245bd5dfba9 , < fc0cba0c7be8261a1625098bd1d695077ec621c9 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 4.14.322 , ≤ 4.14.* (semver)
Unaffected: 4.19.291 , ≤ 4.19.* (semver)
Unaffected: 5.4.251 , ≤ 5.4.* (semver)
Unaffected: 5.10.188 , ≤ 5.10.* (semver)
Unaffected: 5.15.121 , ≤ 5.15.* (semver)
Unaffected: 6.1.40 , ≤ 6.1.* (semver)
Unaffected: 6.4.5 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53322",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:27:44.366496Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:32:58.621Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_attr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8a55556cd7e0220486163b1285ce11a8be2ce5fa",
              "status": "affected",
              "version": "715848ca6fffeb6362a50887d9c26245bd5dfba9",
              "versionType": "git"
            },
            {
              "lessThan": "4647d2e88918a078359d1532d90c417a38542c9e",
              "status": "affected",
              "version": "715848ca6fffeb6362a50887d9c26245bd5dfba9",
              "versionType": "git"
            },
            {
              "lessThan": "d25fded78d88e1515439b3ba581684d683e0b6ab",
              "status": "affected",
              "version": "715848ca6fffeb6362a50887d9c26245bd5dfba9",
              "versionType": "git"
            },
            {
              "lessThan": "a9fe97fb7b4ee21bffb76f2acb05769bad27ae70",
              "status": "affected",
              "version": "715848ca6fffeb6362a50887d9c26245bd5dfba9",
              "versionType": "git"
            },
            {
              "lessThan": "079c8264ed9fea8cbcac01ad29040f901cbc3692",
              "status": "affected",
              "version": "715848ca6fffeb6362a50887d9c26245bd5dfba9",
              "versionType": "git"
            },
            {
              "lessThan": "90770dad1eb30967ebd8d37d82830bcf270b3293",
              "status": "affected",
              "version": "715848ca6fffeb6362a50887d9c26245bd5dfba9",
              "versionType": "git"
            },
            {
              "lessThan": "5bcdaafd92be6035ddc77fa76650cf9dd5b864c4",
              "status": "affected",
              "version": "715848ca6fffeb6362a50887d9c26245bd5dfba9",
              "versionType": "git"
            },
            {
              "lessThan": "fc0cba0c7be8261a1625098bd1d695077ec621c9",
              "status": "affected",
              "version": "715848ca6fffeb6362a50887d9c26245bd5dfba9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_attr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.322",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.251",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.322",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.291",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.251",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.188",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.121",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.40",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.5",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Wait for io return on terminate rport\n\nSystem crash due to use after free.\nCurrent code allows terminate_rport_io to exit before making\nsure all IOs has returned. For FCP-2 device, IO\u0027s can hang\non in HW because driver has not tear down the session in FW at\nfirst sign of cable pull. When dev_loss_tmo timer pops,\nterminate_rport_io is called and upper layer is about to\nfree various resources. Terminate_rport_io trigger qla to do\nthe final cleanup, but the cleanup might not be fast enough where it\nleave qla still holding on to the same resource.\n\nWait for IO\u0027s to return to upper layer before resources are freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in the qla2xxx Fibre Channel HBA driver and is reached when an FC remote port is lost (cable pull, fabric LOGO, or target disappearance) on the SAN fabric. An attacker on the same FC fabric can force that loss without Internet-wide reachability, so Adjacent is the correct vector.\nAC:L - A fabric-adjacent attacker can induce remote-port loss while I/O is outstanding against an FCP-2 target; the FCP-2 hang-until-terminate behavior is a deterministic driver path, not a condition outside attacker influence. Missing the wait makes the UAF reliably follow that sequence.\nPR:N - Remote-port deletion and the subsequent terminate_rport_io callback are driven by FC fabric/link events processed in the host driver with no host authentication or privilege check. No local account or capability on the victim host is required.\nUI:N - After port loss, the FC transport automatically runs the dev_loss_tmo/fast_io_fail timers and calls terminate_rport_io without any user action such as mounting a filesystem or opening a device.\nS:U - The vulnerability corrupts and crashes the host kernel that owns the qla2xxx driver. It does not cross a VM, IOMMU, or other separate security authority boundary.\nC:H - The commit documents a use-after-free on resources still referenced by outstanding I/O after the upper layer frees them. Per kernel UAF guidance, that enables disclosure of freed-object contents via heap reuse.\nI:H - The same use-after-free on SCSI/command path structures can be leveraged for heap shaping and arbitrary write or control-flow hijacking once the freed object is reclaimed.\nA:H - The fix explicitly addresses a system crash from the use-after-free when straggling I/Os complete against freed resources, so availability impact is a kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:13:31.190Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8a55556cd7e0220486163b1285ce11a8be2ce5fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/4647d2e88918a078359d1532d90c417a38542c9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d25fded78d88e1515439b3ba581684d683e0b6ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9fe97fb7b4ee21bffb76f2acb05769bad27ae70"
        },
        {
          "url": "https://git.kernel.org/stable/c/079c8264ed9fea8cbcac01ad29040f901cbc3692"
        },
        {
          "url": "https://git.kernel.org/stable/c/90770dad1eb30967ebd8d37d82830bcf270b3293"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bcdaafd92be6035ddc77fa76650cf9dd5b864c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc0cba0c7be8261a1625098bd1d695077ec621c9"
        }
      ],
      "title": "scsi: qla2xxx: Wait for io return on terminate rport",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53322",
    "datePublished": "2025-09-16T16:11:58.062Z",
    "dateReserved": "2025-09-16T16:08:59.563Z",
    "dateUpdated": "2026-08-05T09:13:31.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53322",
      "date": "2026-08-05",
      "epss": "0.00197",
      "percentile": "0.09617"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53322\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-16T17:15:38.287\",\"lastModified\":\"2026-06-17T06:44:53.170\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qla2xxx: Wait for io return on terminate rport\\n\\nSystem crash due to use after free.\\nCurrent code allows terminate_rport_io to exit before making\\nsure all IOs has returned. For FCP-2 device, IO\u0027s can hang\\non in HW because driver has not tear down the session in FW at\\nfirst sign of cable pull. When dev_loss_tmo timer pops,\\nterminate_rport_io is called and upper layer is about to\\nfree various resources. Terminate_rport_io trigger qla to do\\nthe final cleanup, but the cleanup might not be fast enough where it\\nleave qla still holding on to the same resource.\\n\\nWait for IO\u0027s to return to upper layer before resources are freed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_attr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"715848ca6fffeb6362a50887d9c26245bd5dfba9\",\"lessThan\":\"8a55556cd7e0220486163b1285ce11a8be2ce5fa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"715848ca6fffeb6362a50887d9c26245bd5dfba9\",\"lessThan\":\"4647d2e88918a078359d1532d90c417a38542c9e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"715848ca6fffeb6362a50887d9c26245bd5dfba9\",\"lessThan\":\"d25fded78d88e1515439b3ba581684d683e0b6ab\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"715848ca6fffeb6362a50887d9c26245bd5dfba9\",\"lessThan\":\"a9fe97fb7b4ee21bffb76f2acb05769bad27ae70\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"715848ca6fffeb6362a50887d9c26245bd5dfba9\",\"lessThan\":\"079c8264ed9fea8cbcac01ad29040f901cbc3692\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"715848ca6fffeb6362a50887d9c26245bd5dfba9\",\"lessThan\":\"90770dad1eb30967ebd8d37d82830bcf270b3293\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"715848ca6fffeb6362a50887d9c26245bd5dfba9\",\"lessThan\":\"5bcdaafd92be6035ddc77fa76650cf9dd5b864c4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"715848ca6fffeb6362a50887d9c26245bd5dfba9\",\"lessThan\":\"fc0cba0c7be8261a1625098bd1d695077ec621c9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_attr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.34\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.34\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.322\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.291\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.251\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.188\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.121\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.40\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.5\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T18:27:44.366496Z\",\"id\":\"CVE-2023-53322\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.14.322\",\"matchCriteriaId\":\"90AC7CB1-E8BF-40AF-84E7-2196AD6394B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.291\",\"matchCriteriaId\":\"D2D2CA9F-4CC4-4AF5-8C6D-E58415AB782E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.251\",\"matchCriteriaId\":\"7FA663C4-CA72-4B5A-8592-7354D978F58E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.188\",\"matchCriteriaId\":\"43CAE50A-4A6C-488E-813C-F8DB77C13C8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.121\",\"matchCriteriaId\":\"EC77775B-EC31-4966-966C-1286C02B2A85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.40\",\"matchCriteriaId\":\"69315BCC-36D2-45CD-84F8-381EDF8E38F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.4.5\",\"matchCriteriaId\":\"923F6AEA-C2EF-4B08-B038-69A18F3D41F8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/079c8264ed9fea8cbcac01ad29040f901cbc3692\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4647d2e88918a078359d1532d90c417a38542c9e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5bcdaafd92be6035ddc77fa76650cf9dd5b864c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a55556cd7e0220486163b1285ce11a8be2ce5fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/90770dad1eb30967ebd8d37d82830bcf270b3293\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9fe97fb7b4ee21bffb76f2acb05769bad27ae70\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d25fded78d88e1515439b3ba581684d683e0b6ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc0cba0c7be8261a1625098bd1d695077ec621c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:20:17+00:00",
      "cve": "CVE-2023-53322",
      "id": "CVE-2023-53322",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "1162",
      "product_status:known_affected": "52",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: qla2xxx: Wait for io return on terminate rport",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53322.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-53322\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T18:27:44.366496Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T18:27:40.358Z\"}}], \"cna\": {\"title\": \"scsi: qla2xxx: Wait for io return on terminate rport\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"715848ca6fffeb6362a50887d9c26245bd5dfba9\", \"lessThan\": \"8a55556cd7e0220486163b1285ce11a8be2ce5fa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"715848ca6fffeb6362a50887d9c26245bd5dfba9\", \"lessThan\": \"4647d2e88918a078359d1532d90c417a38542c9e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"715848ca6fffeb6362a50887d9c26245bd5dfba9\", \"lessThan\": \"d25fded78d88e1515439b3ba581684d683e0b6ab\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"715848ca6fffeb6362a50887d9c26245bd5dfba9\", \"lessThan\": \"a9fe97fb7b4ee21bffb76f2acb05769bad27ae70\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"715848ca6fffeb6362a50887d9c26245bd5dfba9\", \"lessThan\": \"079c8264ed9fea8cbcac01ad29040f901cbc3692\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"715848ca6fffeb6362a50887d9c26245bd5dfba9\", \"lessThan\": \"90770dad1eb30967ebd8d37d82830bcf270b3293\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"715848ca6fffeb6362a50887d9c26245bd5dfba9\", \"lessThan\": \"5bcdaafd92be6035ddc77fa76650cf9dd5b864c4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"715848ca6fffeb6362a50887d9c26245bd5dfba9\", \"lessThan\": \"fc0cba0c7be8261a1625098bd1d695077ec621c9\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/scsi/qla2xxx/qla_attr.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.34\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.34\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.322\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.291\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.251\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.188\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.121\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.40\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.4.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.4.*\"}, {\"status\": \"unaffected\", \"version\": \"6.5\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/scsi/qla2xxx/qla_attr.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8a55556cd7e0220486163b1285ce11a8be2ce5fa\"}, {\"url\": \"https://git.kernel.org/stable/c/4647d2e88918a078359d1532d90c417a38542c9e\"}, {\"url\": \"https://git.kernel.org/stable/c/d25fded78d88e1515439b3ba581684d683e0b6ab\"}, {\"url\": \"https://git.kernel.org/stable/c/a9fe97fb7b4ee21bffb76f2acb05769bad27ae70\"}, {\"url\": \"https://git.kernel.org/stable/c/079c8264ed9fea8cbcac01ad29040f901cbc3692\"}, {\"url\": \"https://git.kernel.org/stable/c/90770dad1eb30967ebd8d37d82830bcf270b3293\"}, {\"url\": \"https://git.kernel.org/stable/c/5bcdaafd92be6035ddc77fa76650cf9dd5b864c4\"}, {\"url\": \"https://git.kernel.org/stable/c/fc0cba0c7be8261a1625098bd1d695077ec621c9\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qla2xxx: Wait for io return on terminate rport\\n\\nSystem crash due to use after free.\\nCurrent code allows terminate_rport_io to exit before making\\nsure all IOs has returned. For FCP-2 device, IO\u0027s can hang\\non in HW because driver has not tear down the session in FW at\\nfirst sign of cable pull. When dev_loss_tmo timer pops,\\nterminate_rport_io is called and upper layer is about to\\nfree various resources. Terminate_rport_io trigger qla to do\\nthe final cleanup, but the cleanup might not be fast enough where it\\nleave qla still holding on to the same resource.\\n\\nWait for IO\u0027s to return to upper layer before resources are freed.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.322\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.291\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.251\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.188\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.121\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.40\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.4.5\", \"versionStartIncluding\": \"2.6.34\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.5\", \"versionStartIncluding\": \"2.6.34\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T19:42:42.431Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-53322\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T19:42:42.431Z\", \"dateReserved\": \"2025-09-16T16:08:59.563Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-16T16:11:58.062Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.