CVE-2023-54154 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Fix target_cmd_counter leak
The target_cmd_counter struct allocated via target_alloc_cmd_counter() is never freed, resulting in leaks across various transport types, e.g.:
unreferenced object 0xffff88801f920120 (size 96): comm "sh", pid 102, jiffies 4294892535 (age 713.412s) hex dump (first 32 bytes): 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 38 01 92 1f 80 88 ff ff ........8....... backtrace: [<00000000e58a6252>] kmalloc_trace+0x11/0x20
[<0000000043af4b2f>] target_alloc_cmd_counter+0x17/0x90 [target_core_mod]
[<000000007da2dfa7>] target_setup_session+0x2d/0x140 [target_core_mod]
[<0000000068feef86>] tcm_loop_tpg_nexus_store+0x19b/0x350 [tcm_loop]
[<000000006a80e021>] configfs_write_iter+0xb1/0x120
[<00000000e9f4d860>] vfs_write+0x2e4/0x3c0
[<000000008143433b>] ksys_write+0x80/0xb0
[<00000000a7df29b2>] do_syscall_64+0x42/0x90
[<0000000053f45fb8>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Free the structure alongside the corresponding iscsit_conn / se_sess parent.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 01/03/2026
This vulnerability represents a critical memory management flaw in the Linux kernel's SCSI target core subsystem where the target_cmd_counter structure fails to be properly deallocated during session cleanup operations. The issue manifests as a memory leak affecting multiple transport types within the target core module, specifically when handling iSCSI sessions and related connections. The leaked structure, sized at 96 bytes, demonstrates a classic case of unreferenced object accumulation that can persist throughout system operation, potentially leading to gradual memory exhaustion and degraded system performance over time. The leak occurs during the target_setup_session function execution when target_alloc_cmd_counter is called but never properly freed during connection or session termination.
The technical implementation flaw stems from improper resource management within the SCSI target subsystem where the target_cmd_counter allocation lacks corresponding deallocation logic. This pattern violates fundamental memory management principles and creates a persistent memory leak that accumulates across multiple session setups and teardowns. The vulnerability affects the target_core_mod kernel module and specifically impacts the tcm_loop transport type, as evidenced by the stack trace showing the allocation path through target_alloc_cmd_counter to target_setup_session and ultimately to tcm_loop_tpg_nexus_store. The leak occurs because the parent structures iscsit_conn and se_sess contain references to the target_cmd_counter but do not include cleanup logic to release these allocated resources during their own destruction.
The operational impact of this vulnerability extends beyond simple memory consumption to potentially affect system stability and performance under sustained workload conditions. While the immediate effect may appear as minor memory fragmentation, the cumulative nature of the leak means that systems operating with frequent SCSI session creation and destruction will experience progressive memory pressure. This could lead to system slowdowns, memory allocation failures, or in extreme cases, system instability or crashes. The vulnerability is particularly concerning in high-availability environments or systems handling numerous concurrent storage connections where the leak amplifies over time, creating a persistent degradation that may not be immediately apparent to administrators.
The fix addresses this by implementing proper resource cleanup that ensures the target_cmd_counter structure is freed in conjunction with its parent iscsit_conn and se_sess structures during normal session termination. This approach aligns with established security practices for memory management and follows the principle of least privilege in resource handling. The solution directly addresses the root cause by establishing proper cleanup hooks that execute when parent objects are destroyed, preventing the accumulation of unreferenced memory blocks. This fix directly relates to CWE-404, which covers improper resource release or memory leaks in software systems, and aligns with ATT&CK technique T1490, which involves resource exhaustion attacks that can be facilitated by memory leaks in system components. The resolution ensures proper lifecycle management of kernel objects and prevents the accumulation of memory that could be exploited or cause system instability over extended periods of operation.