Linux Kernel up to 6.2.8 scsi alua_activate memory leak

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.2.8 and classified as critical. The impacted element is the function alua_activate of the component scsi. The manipulation results in memory leak. This vulnerability was named CVE-2023-53078. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.2.8. It has been classified as critical. Affected is the function alua_activate of the component scsi. The manipulation with an unknown input leads to a memory leak vulnerability. CWE is classifying the issue as CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. This is going to have an impact on availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak: unreferenced object 0xffff88810b2c6980 (size 32): comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. backtrace: [<0000000098f3a26d>] alua_activate+0xb0/0x320 [<000000003b529641>] scsi_dh_activate+0xb2/0x140 [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath] [<000000007adc9ace>] process_one_work+0x3c5/0x730 [<00000000c457a985>] worker_thread+0x93/0x650 [<00000000cb80e628>] kthread+0x1ba/0x210 [<00000000a1e61077>] ret_from_fork+0x22/0x30 Fix the problem by freeing 'qdata' in error path.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2023-53078 since 05/02/2025. The exploitability is told to be difficult. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 302981 (EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-1637)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.14.312, 4.19.280, 5.4.240, 5.10.177, 5.15.105, 6.1.22 or 6.2.9 eliminates this vulnerability. Applying the patch 123483df146492ca22b503ae6dacc2ce7c3a3974/c110051d335ef7f62ad33474b0c23997fee5bfb5/5c4d71424df34fc23dc5336d09394ce68c849542/c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8/9311e7a554dffd3823499e309a8b86a5cd1540e5/1c55982beb80c7d3c30278fc6cfda8496a31dbe6/0d89254a4320eb7de0970c478172f764125c6355/a13faca032acbf2699293587085293bdfaafc8ae is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (302981). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.14.311
• 4.19.279
• 5.4.239
• 5.10.176
• 5.15.104
• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 6.1.8
• 6.1.9
• 6.1.10
• 6.1.11
• 6.1.12
• 6.1.13
• 6.1.14
• 6.1.15
• 6.1.16
• 6.1.17
• 6.1.18
• 6.1.19
• 6.1.20
• 6.1.21
• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.2.8

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion