CVE-2023-53282

published 2025-09-16

CVE-2023-53282: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write During the…

Priority P3 41 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write

During the sysfs firmware write process, a use-after-free read warning is
logged from the lpfc_wr_object() routine:

BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc]
Use-after-free read at 0x0000000000cf164d (in kfence-#111):
lpfc_wr_object+0x235/0x310 [lpfc]
lpfc_write_firmware.cold+0x206/0x30d [lpfc]
lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc]
lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc]
kernfs_fop_write_iter+0x121/0x1b0
new_sync_write+0x11c/0x1b0
vfs_write+0x1ef/0x280
ksys_write+0x5f/0xe0
do_syscall_64+0x59/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd

The driver accessed wr_object pointer data, which was initialized into
mailbox payload memory, after the mailbox object was released back to the
mailbox pool.

Fix by moving the mailbox free calls to the end of the routine ensuring
that we don't reference internal mailbox memory after release.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.20-1 (bookworm)	linux 6.1.20-1 (bookworm)
linux	linux	—	—
linux	linux	>= 52d5244096017bbd11164479116baceaede342b0 < 51ab4eb1a25e73c7fc2ad9026520c4d8369c93cc	51ab4eb1a25e73c7fc2ad9026520c4d8369c93cc
linux	linux	>= 52d5244096017bbd11164479116baceaede342b0 < 8dfefa8f424ab208e552df1bfd008b732f3d0ad1	8dfefa8f424ab208e552df1bfd008b732f3d0ad1
linux	linux	>= 52d5244096017bbd11164479116baceaede342b0 < 8becb97918f04bb177bc9c4e00c2bdb302e00944	8becb97918f04bb177bc9c4e00c2bdb302e00944
linux	linux	>= 52d5244096017bbd11164479116baceaede342b0 < 21681b81b9ae548c5dae7ae00d931197a27f480c	21681b81b9ae548c5dae7ae00d931197a27f480c
linux	linux_kernel	< 5.15.99	5.15.99
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 5.16 < 6.1.16	6.1.16
linux	linux_kernel	>= 6.2 < 6.2.3	6.2.3

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv 7.8 HIGH

vendor_debian 7.8 HIGH

vendor_redhat 7.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416