CVE-2023-53586 — Double Free in Linux

CWE-415 — Double FreeCWE-821 — Incorrect Synchronization5 documents5 sources
Severity
4.7MEDIUMNVD
EPSS
0.0%
top 97.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedOct 4

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix multiple LUN_RESET handling This fixes a bug where an initiator thinks a LUN_RESET has cleaned up running commands when it hasn't. The bug was added in commit 51ec502a3266 ("target: Delete tmr from list before processing"). The problem occurs when: 1. We have N I/O cmds running in the target layer spread over 2 sessions. 2. The initiator sends a LUN_RESET for each session. 3. session1's LUN_RESET loops ov…

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.0 | Impact: 3.6

Affected Packages4 packages

▶NVDlinux/linux_kernel4.11 — 5.10.180+4
▶Debianlinux/linux_kernel< 5.10.191-1+3
▶CVEListV5linux/linux51ec502a32665fed66c7f03799ede4023b212536 — e1f59cd18a10969d08a082264b557876ca38766e+6
▶debiandebian/linux< linux 6.1.37-1 (bookworm)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

2
OSV
CVE-2023-53586: In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix multiple LUN_RESET handling This fixes a bug where an initiator↗2025-10-04
▶
GHSA
GHSA-8mqg-3fc7-qr47: In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix multiple LUN_RESET handling This fixes a bug where an initiato↗2025-10-04
▶

📋Vendor Advisories

2
Red Hat
kernel: scsi: target: Fix multiple LUN_RESET handling↗2025-10-04
▶
Debian
CVE-2023-53586: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: targe...↗2023
▶