CVE-2023-54289 — Access of Uninitialized Pointer in Linux
Severity
4.7MEDIUM
No vectorEPSS
0.0%
top 89.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 30
Description
In the Linux kernel, the following vulnerability has been resolved:
scsi: qedf: Fix NULL dereference in error handling
Smatch reported:
drivers/scsi/qedf/qedf_main.c:3056 qedf_alloc_global_queues()
warn: missing unwind goto?
At this point in the function, nothing has been allocated so we can return
directly. In particular the "qedf->global_queues" have not been allocated
so calling qedf_free_global_queues() will lead to a NULL dereference when
we check if (!gl[i]) and "gl" is NULL.
Affected Packages4 packages
▶CVEListV5linux/linux61d8658b4a435eac729966cc94cdda077a8df5cd — 961c8370c5f7e80a267680476e1bcff34bffe71a+7
🔴Vulnerability Details
3OSV▶
CVE-2023-54289: In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix NULL dereference in error handling Smatch reported: drivers/scsi/q↗2025-12-30
GHSA▶
GHSA-qw59-8j4j-9xwf: In the Linux kernel, the following vulnerability has been resolved:
scsi: qedf: Fix NULL dereference in error handling
Smatch reported:
drivers/scs↗2025-12-30