Linux Kernel Vulnerability in QLA2XXX by Broadcom

CVE-2023-53280

What is CVE-2023-53280?

This vulnerability in the Linux kernel arises from improper handling of the nvme_ls_waitq wait queue within the QLA2XXX driver. When the function qla2x00_start_sp(sp) returns an error code EGAIN, it leads to attempts to wake up an uninitialized wait queue. As a result, this can cause a system crash due to a NULL pointer dereference, which exposes the system to instability and unexpected behavior during operation. The problematic queue logic has been addressed in recent commits, ensuring better stability and reliability for users of affected kernel versions.

References