CVE-2023-53322

A flaw was found in the Linux kernel’s SCSI driver component qla2xxx (used with FCP-2 devices). When the terminate_rport_io() function is invoked , the driver may exit cleanup before all outstanding I/O operations have returned. This can lead to a use-after-free condition when resources are freed while I/Os are still pending.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires physical or fabric disruption, specific Fibre Channel hardware, and complex timing between connection loss timeouts and active I/O. Systems are only exposed if they utilize QLogic Fibre Channel host bus adapters interacting with FCP-2 targets. Because the condition is triggered by link loss events such as cable disconnects during ongoing traffic, malicious triggering would require specialized fabric-level or physical access, limiting the scope of attack to local denial of service through kernel panic or potential memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.