CVE-2023-54289

CVE-2023-54289: Linux kernel SCSI qedf NULL-dereference in error path. The issue occurs when qedf_alloc_global_queues() handles an error before any allocation; qedf_free_global_queues() would dereference a NULL gl, causing a crash. The fixed behavior returns early when nothing has been allocated ...

CVE-2022-50850 scsi: ipr: Fix WARNING in ipr_init()

In the Linux kernel, the following vulnerability has been resolved: scsi: ipr: Fix WARNING in iprinit iprinit will not call unregisterrebootnotifier when pciregisterdriver fails, which causes a WARNING. Call unregisterrebootnotifier when pciregisterdriver fails. notifier callback iprhalt ipr...

CVE-2022-50850

CVE-2022-50850 affects the Linux kernel component: scsi/ipr. The issue described is a WARNING raised when ipr_init() calls unregister_reboot_notifier() if pci_register_driver() fails, leading to a logged WARN and a notifier chain risk. Patches fix the root cause by ensuring unregister_reboot_noti...

CVE-2022-50850

In the Linux kernel, the following vulnerability has been resolved: scsi: ipr: Fix WARNING in iprinit iprinit will not call unregisterrebootnotifier when pciregisterdriver fails, which causes a WARNING. Call unregisterrebootnotifier when pciregisterdriver fails. notifier callback iprhalt ipr...

CVE-2023-54234 scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix missing mrioc-evtackcmds initialization Commit c1af985d27da "scsi: mpi3mr: Add Event acknowledgment logic" introduced an array mrioc-evtackcmds but initialization of the array elements was missed. They are just...

CVE-2023-54234

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix missing mrioc-evtackcmds initialization Commit c1af985d27da "scsi: mpi3mr: Add Event acknowledgment logic" introduced an array mrioc-evtackcmds but initialization of the array elements was missed. They are just...

CVE-2023-54234

The CVE-2023-54234 issue is concrete: in the Linux kernel, the MPI3 MR SCSI driver (scsi: mpi3mr) had an uninitialized mrioc->evtack_cmds array, causing mpi3mr_complete_evt_ack() to access host_tag fields that were zeroed. This could lead to incorrect bit indexing when clearing mrico->evtac...

CVE-2023-54234 scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix missing mrioc-evtackcmds initialization Commit c1af985d27da "scsi: mpi3mr: Add Event acknowledgment logic" introduced an array mrioc-evtackcmds but initialization of the array elements was missed. They are just...

CVE-2022-50840 scsi: snic: Fix possible UAF in snic_tgt_create()

In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible UAF in snictgtcreate Smatch reports a warning as follows: drivers/scsi/snic/snicdisc.c:307 snictgtcreate warn: '&tgt-list' not removed from list If deviceadd fails in snictgtcreate, tgt will be freed, but...

CVE-2023-54184 scsi: target: iscsit: Free cmds before session free

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace: Time2Retain timer expired for...

CVE-2023-54184

CVE-2023-54184 affects the Linux kernel scsi target iscsit: recovery entries cleanup order caused use-after-free or NULL pointer dereference when freeing cmds after a session. Connected advisories (SUSE/SU-2026-1078 and OSV entries) confirm the issue and show the fixed sequence: move cleanup of r...

CVE-2023-54184

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace: Time2Retain timer expired for...

CVE-2023-54179 scsi: qla2xxx: Array index may go out of bound

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Array index may go out of bound Klocwork reports array 'vha-hoststr' of size 16 may use index values 16..19. Use snprintf instead of sprintf...

CVE-2023-54179

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Array index may go out of bound Klocwork reports array 'vha-hoststr' of size 16 may use index values 16..19. Use snprintf instead of sprintf...

CVE-2023-54179

Technical details about CVE-2023-54179 (Linux kernel scsi: qla2xxx array index out of bound) are not provided in the connected documents. Monitor for updates from SUSE/OpenVAS/OSV references.

CVE-2023-54179 scsi: qla2xxx: Array index may go out of bound

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Array index may go out of bound Klocwork reports array 'vha-hoststr' of size 16 may use index values 16..19. Use snprintf instead of sprintf...

CVE-2022-50827

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfccreateport Commit 5e633302ace1 "scsi: lpfc: vmid: Add support for VMID in mailbox command" introduced allocations for the VMID resources in lpfccreateport after the call to scsihostalloc. Upon...

CVE-2022-50818 scsi: pm8001: Fix running_req for internal abort commands

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix runningreq for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@none$ more /sys/class/sasphy/phy-0:0:8/targetportprotocols sata root@none$ echo 0...

CVE-2022-50818

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix runningreq for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@none$ more /sys/class/sasphy/phy-0:0:8/targetportprotocols sata root@none$ echo 0...

CVE-2022-50818

CVE-2022-50818 concerns the Linux kernel SCSI PM8001 subsystem. The fixed issue is in the per-device running_req accounting for internal abort commands: a race/defect prevented running_req from decrementing after internal abort completion, causing a hang in SAS/SATA paths (notably when disabling ...