CVE-2023-53586

A race condition flaw was found in the Linux kernel SCSI target subsystem's LUN_RESET handling. When multiple remote initiator sessions send concurrent LUN_RESET commands, one session's reset can incorrectly drain commands from another session, causing the second session to receive a successful reset response even though its commands weren't cleaned up, which results in the initiator reissuing commands while the old ones are still executing and leads to command confusion and potential data integrity issues.

The issue arises because LUN_RESET operations from different sessions aren't properly serialized. When session1's LUN_RESET begins processing, it moves all running commands (from both sessions) to its local drain_task_list. Meanwhile, session2's LUN_RESET doesn't see session1's reset operation (because it removed itself from the TMR list) and doesn't see any commands (because session1 moved them). Session2 then incorrectly reports success to its initiator. The initiator believes its commands are aborted and reissues them, but the backend eventually completes the original commands, returning aborted task statuses. The initiator then encounters invalid ITT errors or accidentally looks up reused ITTs. This can cause I/O errors and potential data corruption if reissued commands overlap with still-executing original commands. The race requires precise timing between multiple sessions sending LUN_RESET commands concurrently.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.