CVE-2023-53609

A use-after-free flaw was found in the Linux kernel's SCSI subsystem in the command dispatch error handling. A local user can trigger this issue through specific SCSI device operations that cause dispatch failures, where the code attempts to increment a reference counter on a device structure that may have already been freed after returning from the dispatch function. This results in accessing freed memory, leading to kernel panic or potential memory corruption.

The vulnerability was introduced by a commit that attempted to fix reference counting by incrementing iorequest_cnt after dispatch. However, the design assumption that cmd->device remains valid after scsi_dispatch_cmd() returns is incorrect—the device structure can be freed during or immediately after dispatch in certain error scenarios. When the code then attempts to access cmd->device->iorequest_cnt, it dereferences freed memory. This race window is narrow and requires specific error conditions during SCSI command dispatch, such as device removal concurrent with I/O operations or certain failure paths in lower-level drivers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.