Linux Kernel up to 6.3.12/6.4.3 ufshcd.c ufshcd_queuecommand double free

Summaryinfo

A vulnerability labeled as problematic has been found in Linux Kernel up to 6.3.12/6.4.3. This vulnerability affects the function ufshcd_queuecommand of the file drivers/ufs/core/ufshcd.c. Executing a manipulation can lead to an unknown weakness. This vulnerability is registered as CVE-2023-53510. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.3.12/6.4.3 and classified as problematic. This vulnerability affects the function ufshcd_queuecommand of the file drivers/ufs/core/ufshcd.c. The CWE definition for the vulnerability is CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix handling of lrbp->cmd ufshcd_queuecommand() may be called two times in a row for a SCSI command before it is completed. Hence make the following changes: - In the functions that submit a command, do not check the old value of lrbp->cmd nor clear lrbp->cmd in error paths. - In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd. See also scsi_send_eh_cmnd(). This commit prevents that the following appears if a command times out: WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8 Call trace: ufshcd_queuecommand+0x6f8/0x9a8 scsi_send_eh_cmnd+0x2c0/0x960 scsi_eh_test_devices+0x100/0x314 scsi_eh_ready_devs+0xd90/0x114c scsi_error_handler+0x2b4/0xb70 kthread+0x16c/0x1e0

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2023-53510 since 10/01/2025. The exploitation appears to be difficult. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/03/2026).

The vulnerability scanner Nessus provides a plugin with the ID 311783 (Debian dla-4561 : linux-config-6.1 - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.3.13 or 6.4.4 eliminates this vulnerability. Applying the patch f3ee24af62681b942bbd799ac77b90a6d7e1fdb1/49234a401e161a2f2698f4612ab792c49b3cad1b/549e91a9bbaa0ee480f59357868421a61d369770 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (311783), EUVD (EUVD-2025-32785) and CERT Bund (WID-SEC-2025-2187). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• Open Source Linux Kernel
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.3.0
• 6.3.1
• 6.3.2
• 6.3.3
• 6.3.4
• 6.3.5
• 6.3.6
• 6.3.7
• 6.3.8
• 6.3.9
• 6.3.10
• 6.3.11
• 6.3.12
• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion