CVE-2023-53754 scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
A null pointer dereference in the lpfc SCSI driver can cause a kernel warning or crash, requiring local access to exploit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53754?
CVE-2023-53754 is a vulnerability in Linux, published on 8 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
When if_type equals zero and pci_resource_start(pdev, PCI_64BIT_BAR4) returns false, drbl_regs_memmap_p is not remapped. This passes a NULL pointer to iounmap(), which can trigger a WARN() on certain arches.
When if_type equals six and pci_resource_start(pdev, PCI_64BIT_BAR4) returns true, drbl_regs_memmap_p may has been remapped and ctrl_regs_memmap_p is not remapped. This is a resource leak and passes a NULL pointer to iounmap().
To fix these issues, we need to add null checks before iounmap(), and change some goto labels.
Which versions are affected by CVE-2023-53754?
How do I fix CVE-2023-53754?
Apply the vendor's patch.
Is CVE-2023-53754 being exploited?
There is no known exploitation of CVE-2023-53754 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-53754, DEBIAN-CVE-2023-53754, GHSA-48c4-xwvf-f6cx, UBUNTU-CVE-2023-53754.