Executive brief
The Linux kernel's qla2xxx SCSI driver contains a race condition in session deletion logic that can cause system crashes due to linked list corruption. The vulnerability allows the same port session to be queued for deletion twice simultaneously on different CPU cores, leading to memory corruption and kernel panics.
Technical details
The vulnerability is a race condition (CWE-362) in the qla2xxx driver's session deletion mechanism. The root cause is insufficient locking when checking and clearing the session "deleted" flag, allowing concurrent threads to race and queue the same session for deletion multiple times. The attack vector is local (affects kernel memory management during normal operation), triggered when session state transitions occur in FC (Fibre Channel) fabric discovery. The fix moves the deleted flag clearing/setting operations under spin_lock_irqsave protection to ensure atomicity. A patch was committed to the Linux kernel stable tree in July 2023.
Affected products
- Linux Linux kernel affected versions before fix commit 6dfe4344c168c6ca20fe7640649aacfcefcccb26 (July 2023)
Timeline
- 2023-07-14: disclosed: Patch authored by Quinn Tran
- 2023-07-23: patched: Patch merged upstream (commit 6dfe4344c168c6ca20fe7640649aacfcefcccb26)
- 2023-09-19: patched: Patch backported to stable kernels
- 2025-10-04: advisory: CVE-2023-53615 published to NVD