GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54100 (GCVE-0-2023-54100)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:06 – Updated: 2026-08-05 09:17
VLAI
Title
scsi: qedi: Fix use after free bug in qedi_remove()
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix use after free bug in qedi_remove() In qedi_probe() we call __qedi_probe() which initializes &qedi->recovery_work with qedi_recovery_handler() and &qedi->board_disable_work with qedi_board_disable_work(). When qedi_schedule_recovery_handler() is called, schedule_delayed_work() will finally start the work. In qedi_remove(), which is called to remove the driver, the following sequence may be observed: Fix this by finishing the work before cleanup in qedi_remove(). CPU0 CPU1 |qedi_recovery_handler qedi_remove | __qedi_remove | iscsi_host_free | scsi_host_put | //free shost | |iscsi_host_for_each_session |//use qedi->shost Cancel recovery_work and board_disable_work in __qedi_remove().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4b1068f5d74b6cc92319bd7eba40809b1222e73f , < fa19c533ab19161298f0780bcc6523af88f6fd20 (git)
Affected: 4b1068f5d74b6cc92319bd7eba40809b1222e73f , < 5e756a59cee6a8a79b9059c5bdf0ecbf5bb8d151 (git)
Affected: 4b1068f5d74b6cc92319bd7eba40809b1222e73f , < 3738a230831e861503119ee2691c4a7dc56ed60a (git)
Affected: 4b1068f5d74b6cc92319bd7eba40809b1222e73f , < 89f6023fc321c958a0fb11f143a6eb4544ae3940 (git)
Affected: 4b1068f5d74b6cc92319bd7eba40809b1222e73f , < 124027cd1a624ce0347adcd59241a9966a726b22 (git)
Affected: 4b1068f5d74b6cc92319bd7eba40809b1222e73f , < c5749639f2d0a1f6cbe187d05f70c2e7c544d748 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.10.180 , ≤ 5.10.* (semver)
Unaffected: 5.15.112 , ≤ 5.15.* (semver)
Unaffected: 6.1.29 , ≤ 6.1.* (semver)
Unaffected: 6.2.16 , ≤ 6.2.* (semver)
Unaffected: 6.3.3 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qedi/qedi_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fa19c533ab19161298f0780bcc6523af88f6fd20",
              "status": "affected",
              "version": "4b1068f5d74b6cc92319bd7eba40809b1222e73f",
              "versionType": "git"
            },
            {
              "lessThan": "5e756a59cee6a8a79b9059c5bdf0ecbf5bb8d151",
              "status": "affected",
              "version": "4b1068f5d74b6cc92319bd7eba40809b1222e73f",
              "versionType": "git"
            },
            {
              "lessThan": "3738a230831e861503119ee2691c4a7dc56ed60a",
              "status": "affected",
              "version": "4b1068f5d74b6cc92319bd7eba40809b1222e73f",
              "versionType": "git"
            },
            {
              "lessThan": "89f6023fc321c958a0fb11f143a6eb4544ae3940",
              "status": "affected",
              "version": "4b1068f5d74b6cc92319bd7eba40809b1222e73f",
              "versionType": "git"
            },
            {
              "lessThan": "124027cd1a624ce0347adcd59241a9966a726b22",
              "status": "affected",
              "version": "4b1068f5d74b6cc92319bd7eba40809b1222e73f",
              "versionType": "git"
            },
            {
              "lessThan": "c5749639f2d0a1f6cbe187d05f70c2e7c544d748",
              "status": "affected",
              "version": "4b1068f5d74b6cc92319bd7eba40809b1222e73f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qedi/qedi_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.180",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.112",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.29",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.16",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.3",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedi: Fix use after free bug in qedi_remove()\n\nIn qedi_probe() we call __qedi_probe() which initializes\n\u0026qedi-\u003erecovery_work with qedi_recovery_handler() and\n\u0026qedi-\u003eboard_disable_work with qedi_board_disable_work().\n\nWhen qedi_schedule_recovery_handler() is called, schedule_delayed_work()\nwill finally start the work.\n\nIn qedi_remove(), which is called to remove the driver, the following\nsequence may be observed:\n\nFix this by finishing the work before cleanup in qedi_remove().\n\nCPU0                  CPU1\n\n                     |qedi_recovery_handler\nqedi_remove          |\n  __qedi_remove      |\niscsi_host_free      |\nscsi_host_put        |\n//free shost         |\n                     |iscsi_host_for_each_session\n                     |//use qedi-\u003eshost\n\nCancel recovery_work and board_disable_work in __qedi_remove()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is between local PCI driver teardown (unbind/rmmod/hotplug of the QLogic FastLinQ iSCSI device) and a locally-schedulable recovery work item; there is no remote or network-facing path into `qedi_remove()` or the devlink health-reporter recover op.\nAC:L - An attacker with local access controls the timing of the device-removal side and can repeatedly re-trigger the recovery/board-disable work (devlink fw_fatal recover, MFW error paths) to widen the window, so the race can be driven deterministically rather than depending on conditions outside the attacker\u0027s influence.\nPR:L - Consistent with prior scoring of this driver-teardown UAF class (e.g. CVE-2025-37838), a low-privileged local account on a host exporting the qedi device/devlink interfaces is treated as sufficient; no authentication beyond local account access is needed to reach the racing work handler.\nUI:N - Both sides of the race are attacker-driven administrative/driver events; no victim action such as opening a file or mounting a filesystem is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `qedi_ctx` is embedded in the freed `Scsi_Host` allocation, so the handler reads `qedi-\u003eshost`, `qedi-\u003ecdev`, and `qedi-\u003epdev` out of freed slab memory; an attacker who reclaims that slot obtains a controlled read primitive and can disclose arbitrary kernel memory.\nI:H - `qedi_recovery_handler()` calls `__qedi_remove()` followed by `__qedi_probe()` on the freed context, writing function pointers, work_structs, and DMA state into the reclaimed allocation \u2014 a powerful write primitive suitable for control-flow hijacking.\nA:H - Even unexploited, dereferencing and re-initializing the freed `Scsi_Host`/`qedi_ctx` and iterating its session list produces slab corruption and a kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:17.178Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fa19c533ab19161298f0780bcc6523af88f6fd20"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e756a59cee6a8a79b9059c5bdf0ecbf5bb8d151"
        },
        {
          "url": "https://git.kernel.org/stable/c/3738a230831e861503119ee2691c4a7dc56ed60a"
        },
        {
          "url": "https://git.kernel.org/stable/c/89f6023fc321c958a0fb11f143a6eb4544ae3940"
        },
        {
          "url": "https://git.kernel.org/stable/c/124027cd1a624ce0347adcd59241a9966a726b22"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5749639f2d0a1f6cbe187d05f70c2e7c544d748"
        }
      ],
      "title": "scsi: qedi: Fix use after free bug in qedi_remove()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54100",
    "datePublished": "2025-12-24T13:06:26.560Z",
    "dateReserved": "2025-12-24T13:02:52.517Z",
    "dateUpdated": "2026-08-05T09:17:17.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54100",
      "date": "2026-09-16",
      "epss": "0.00156",
      "percentile": "0.0521"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54100\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:11.890\",\"lastModified\":\"2026-08-04T10:19:29.303\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qedi: Fix use after free bug in qedi_remove()\\n\\nIn qedi_probe() we call __qedi_probe() which initializes\\n\u0026qedi-\u003erecovery_work with qedi_recovery_handler() and\\n\u0026qedi-\u003eboard_disable_work with qedi_board_disable_work().\\n\\nWhen qedi_schedule_recovery_handler() is called, schedule_delayed_work()\\nwill finally start the work.\\n\\nIn qedi_remove(), which is called to remove the driver, the following\\nsequence may be observed:\\n\\nFix this by finishing the work before cleanup in qedi_remove().\\n\\nCPU0                  CPU1\\n\\n                     |qedi_recovery_handler\\nqedi_remove          |\\n  __qedi_remove      |\\niscsi_host_free      |\\nscsi_host_put        |\\n//free shost         |\\n                     |iscsi_host_for_each_session\\n                     |//use qedi-\u003eshost\\n\\nCancel recovery_work and board_disable_work in __qedi_remove().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/qedi/qedi_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4b1068f5d74b6cc92319bd7eba40809b1222e73f\",\"lessThan\":\"fa19c533ab19161298f0780bcc6523af88f6fd20\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4b1068f5d74b6cc92319bd7eba40809b1222e73f\",\"lessThan\":\"5e756a59cee6a8a79b9059c5bdf0ecbf5bb8d151\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4b1068f5d74b6cc92319bd7eba40809b1222e73f\",\"lessThan\":\"3738a230831e861503119ee2691c4a7dc56ed60a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4b1068f5d74b6cc92319bd7eba40809b1222e73f\",\"lessThan\":\"89f6023fc321c958a0fb11f143a6eb4544ae3940\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4b1068f5d74b6cc92319bd7eba40809b1222e73f\",\"lessThan\":\"124027cd1a624ce0347adcd59241a9966a726b22\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4b1068f5d74b6cc92319bd7eba40809b1222e73f\",\"lessThan\":\"c5749639f2d0a1f6cbe187d05f70c2e7c544d748\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/qedi/qedi_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.180\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.112\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.29\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.16\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.3\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/124027cd1a624ce0347adcd59241a9966a726b22\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3738a230831e861503119ee2691c4a7dc56ed60a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5e756a59cee6a8a79b9059c5bdf0ecbf5bb8d151\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/89f6023fc321c958a0fb11f143a6eb4544ae3940\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c5749639f2d0a1f6cbe187d05f70c2e7c544d748\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fa19c533ab19161298f0780bcc6523af88f6fd20\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:52:23+00:00",
      "cve": "CVE-2023-54100",
      "id": "CVE-2023-54100",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "399",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: qedi: Fix use after free bug in qedi_remove()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54100.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-06T17:04:16Z",
      "cve": "CVE-2023-54100",
      "id": "CVE-2023-54100",
      "initial_release_date": "2025-12-25T00:55:38Z",
      "product_status:known_affected": "401",
      "product_status:known_not_affected": "385",
      "product_status:recommended": "245",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54100",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54100.json",
      "version": "23"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.