CVE-2023-54234

kernel: scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization

Loading…

Severity

Low

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · December 30, 2025

Updated · August 5, 2026

Description

A use-after-free vulnerability was found in the MPI3MR SCSI driver. The evtack_cmds array is not properly initialized, causing invalid memory access via clear_bit() with incorrect bit indices during event acknowledgment.

Statement

This affects systems with Broadcom MPI3MR SCSI controllers (eHBA-9600 series). The bug was observed during firmware updates and requires specific hardware to trigger.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-824 · Access of Uninitialized Pointer