CVE-2023-53603
published 2025-10-04CVE-2023-53603: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid fcport pointer dereference Klocwork reported warning of NULL pointer…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.14%
3.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Avoid fcport pointer dereference
Klocwork reported warning of NULL pointer may be dereferenced. The routine
exits when sa_ctl is NULL and fcport is allocated after the exit call thus
causing NULL fcport pointer to dereference at the time of exit.
To avoid fcport pointer dereference, exit the routine when sa_ctl is NULL.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 5.15.61 < 5.15.121 | 5.15.121 |
| linux | linux | >= 5.18.18 < 5.19 | 5.19 |
| linux | linux | >= 5.19.2 < 5.20 | 5.20 |
| linux | linux | >= 7b2fbfa4b2cd3a24c1760b85d842e928070d4744 < 4406fe8a96a946c7ea5724ee59625755a1d9c59d | 4406fe8a96a946c7ea5724ee59625755a1d9c59d |
| linux | linux | >= e0fb8ce2bb9e52c846e54ad2c58b5b7beb13eb09 < 477bc74ad1add644b606bff6ba1284943c42818a | 477bc74ad1add644b606bff6ba1284943c42818a |
| linux | linux | >= e0fb8ce2bb9e52c846e54ad2c58b5b7beb13eb09 < 7bbeff613ec0560fb2f6f8b405288f3f043adf64 | 7bbeff613ec0560fb2f6f8b405288f3f043adf64 |
| linux | linux | >= e0fb8ce2bb9e52c846e54ad2c58b5b7beb13eb09 < 6b504d06976fe4a61cc05dedc68b84fadb397f77 | 6b504d06976fe4a61cc05dedc68b84fadb397f77 |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 5.15.61 < 5.15.121 | 5.15.121 |
| linux | linux_kernel | >= 5.18.18 < 5.19 | 5.19 |
| linux | linux_kernel | >= 5.19.2 < 6.1.40 | 6.1.40 |
| linux | linux_kernel | >= 6.2 < 6.4.5 | 6.4.5 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 5.15.120/6.1.39/6.4.4 sa_ctl null pointer dereference (EUVD-2023-60005 / WID-SEC-2025-2194)
vuldb·2026-04-28·CVSS 5.5
CVE-2023-53603 [MEDIUM] Linux Kernel up to 5.15.120/6.1.39/6.4.4 sa_ctl null pointer dereference (EUVD-2023-60005 / WID-SEC-2025-2194)
A vulnerability was found in Linux Kernel up to 5.15.120/6.1.39/6.4.4 and classified as critical. Impacted is the function sa_ctl. The manipulation results in null pointer dereference.
This vulnerability is identified as CVE-2023-53603. The attack can only be performed from the local network. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
GHSA-2795-wfr2-m5v3: In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Avoid fcport pointer dereference
Klocwork reported warning of NUL
ghsa_unreviewed·2025-10-04
CVE-2023-53603 [MEDIUM] CWE-476 GHSA-2795-wfr2-m5v3: In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Avoid fcport pointer dereference
Klocwork reported warning of NUL
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Avoid fcport pointer dereference
Klocwork reported warning of NULL pointer may be dereferenced. The routine
exits when sa_ctl is NULL and fcport is allocated after the exit call thus
causing NULL fcport pointer to dereference at the time of exit.
To avoid fcport pointer dereference, exit the routine when sa_ctl is NULL.
OSV
CVE-2023-53603: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid fcport pointer dereference Klocwork reported warning of NULL
osv·2025-10-04·CVSS 5.5
CVE-2023-53603 [MEDIUM] CVE-2023-53603: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid fcport pointer dereference Klocwork reported warning of NULL
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid fcport pointer dereference Klocwork reported warning of NULL pointer may be dereferenced. The routine exits when sa_ctl is NULL and fcport is allocated after the exit call thus causing NULL fcport pointer to dereference at the time of exit. To avoid fcport pointer dereference, exit the routine when sa_ctl is NULL.
Red Hat
kernel: scsi: qla2xxx: Avoid fcport pointer dereference
vendor_redhat·2025-10-04·CVSS 5.5
CVE-2023-53603 [MEDIUM] CWE-476 kernel: scsi: qla2xxx: Avoid fcport pointer dereference
kernel: scsi: qla2xxx: Avoid fcport pointer dereference
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Avoid fcport pointer dereference
Klocwork reported warning of NULL pointer may be dereferenced. The routine
exits when sa_ctl is NULL and fcport is allocated after the exit call thus
causing NULL fcport pointer to dereference at the time of exit.
To avoid fcport pointer dereference, exit the routine when sa_ctl is NULL.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Fix deferred
Package: kernel-rt (Red Hat
Debian
CVE-2023-53603: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x...
vendor_debian·2023·CVSS 5.5
CVE-2023-53603 [MEDIUM] CVE-2023-53603: linux - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x...
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid fcport pointer dereference Klocwork reported warning of NULL pointer may be dereferenced. The routine exits when sa_ctl is NULL and fcport is allocated after the exit call thus causing NULL fcport pointer to dereference at the time of exit. To avoid fcport pointer dereference, exit the routine when sa_ctl is NULL.
Scope: local
bookworm: resolved (fixed in 6.1.52-1)
bullseye: resolved
forky: resolved (fixed in 6.4.11-1)
sid: resolved (fixed in 6.4.11-1)
trixie: resolved (fixed in 6.4.11-1)
No detection rules found.
No public exploits indexed.
2025-10-04
Published