Kernel Vulnerability in Linux Affecting SCSI Device Management

CVE-2023-53609

What is CVE-2023-53609?

A vulnerability in the Linux kernel's SCSI subsystem has been identified, related to improper handling of device requests during dispatch operations. The function 'scsi_queue_rq()' was adversely affected, where the atomic increment of the 'iorequest_cnt' could lead to system instability, particularly if the command device had been freed after returning from 'scsi_dispatch_cmd()'. This issue results in a kernel panic, highlighting the necessity for prompt patching and diligent management of device states within the SCSI core.

References