CVE-2023-53609

MEDIUM

Linux Kernel 6.2-6.3.4 - Use-After-Free in SCSI Device Request Dispatch

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed" The "atomic_inc(&cmd->device->iorequest_cnt)" in scsi_queue_rq() would cause kernel panic because cmd->device may be freed after returning from scsi_dispatch_cmd(). This reverts commit cfee29ffb45b1c9798011b19d454637d1b0fe87d.

References (2)

Core 2

Core References

Patch

https://git.kernel.org/stable/c/35fe6fa57b994e7da222893adf0bb748d6055e73

Patch

https://git.kernel.org/stable/c/6ca9818d1624e136a76ae8faedb6b6c95ca66903

Scores

CVSS v3 5.5

EPSS 0.0012

EPSS Percentile 2.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

Status published

Products (9)

linux/Kernel 6.2.0 - 6.3.4linux

Linux/Linux < 6.2

Linux/Linux 6.2

Linux/Linux 6.3.4 - 6.3.*

Linux/Linux 6.4

Linux/Linux cfee29ffb45b1c9798011b19d454637d1b0fe87d - 35fe6fa57b994e7da222893adf0bb748d6055e73

Linux/Linux cfee29ffb45b1c9798011b19d454637d1b0fe87d - 6ca9818d1624e136a76ae8faedb6b6c95ca66903

linux/linux_kernel 6.4 rc1 (2 CPE variants)

linux/linux_kernel 6.2 - 6.3.4

Published Oct 04, 2025

Tracked Since Feb 18, 2026