CVE-2023-53510 scsi: ufs: core: Fix handling of lrbp->cmd
A null pointer dereference in the Linux kernel UFS driver can cause a system crash when a SCSI command times out.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53510?
CVE-2023-53510 is a high-severity vulnerability in Linux kernel, published on 1 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix handling of lrbp->cmd
ufshcd_queuecommand() may be called two times in a row for a SCSI command before it is completed. Hence make the following changes:
- In the functions that submit a command, do not check the old value of lrbp->cmd nor clear lrbp->cmd in error paths.
- In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd.
See also scsi_send_eh_cmnd().
This commit prevents that the following appears if a command times out:
WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8 Call trace: ufshcd_queuecommand+0x6f8/0x9a8 scsi_send_eh_cmnd+0x2c0/0x960 scsi_eh_test_devices+0x100/0x314 scsi_eh_ready_devs+0xd90/0x114c scsi_error_handler+0x2b4/0xb70 kthread+0x16c/0x1e0
Weakness: CWE-415
Which versions are affected by CVE-2023-53510?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53510?
Apply the vendor's patch.
Is CVE-2023-53510 being exploited?
There is no known exploitation of CVE-2023-53510 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-75243, BELL-CVE-2023-53510, DEBIAN-CVE-2023-53510, GHSA-5jfv-85hv-2cmx, ROOT-OS-DEBIAN-11-CVE-2023-53510, ROOT-OS-DEBIAN-12-CVE-2023-53510 and 2 more.