Answer in brief
CVE-2023-53041 records a Medium severity (CVSS 5.5) vulnerability in scsi: qla2xxx: Perform lockless command completion in abort path. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=31c1f455203e56a3ce8d5dd92f37c83d07bd5bd5 <9189f20b4c5307c0998682bb522e481b4567a8b8 || >=f45bca8c5052e8c59bab64ee90c44441678b9a52 <231cfa78ec5badd84a1a2b09465bfad1a926aba1 || >=f45bca8c5052e8c59bab64ee90c44441678b9a52 <d6f7377528d2abf338e504126e44439541be8f7d || >=f45bca8c5052e8c59bab64ee90c44441678b9a52 <cd0a1804ac5bab2545ac700c8d0fe9ae9284c567 || >=f45bca8c5052e8c59bab64ee90c44441678b9a52 <415d614344a4f1bbddf55d724fc7eb9ef4b39aad || >=f45bca8c5052e8c59bab64ee90c44441678b9a52 <0367076b0817d5c75dfb83001ce7ce5c64d803a9 || 10fd34ac79b234d9bd4459c9b9c1f9d5a67f7bde || >=5.4.4 <5.4.240 || >=5.3.17 <5.4 | 9189f20b4c5307c0998682bb522e481b4567a8b8, 231cfa78ec5badd84a1a2b09465bfad1a926aba1, d6f7377528d2abf338e504126e44439541be8f7d, cd0a1804ac5bab2545ac700c8d0fe9ae9284c567, 415d614344a4f1bbddf55d724fc7eb9ef4b39aad, 0367076b0817d5c75dfb83001ce7ce5c64d803a9, 5.4.240, 5.4 |
| Linux/Linuxgeneric | 5.5 | Not reported |
Published upstream
May 2, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 5, 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Perform lockless command completion in abort path While adding and removing the controller, the following call trace was observed: WARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dma_free_attrs+0x33/0x50 CPU: 3 PID: 623596 Comm: sh Kdump: loaded Not tainted 5.14.0-96.el9.x86_64 #1 RIP: 0010:dma_free_attrs+0x33/0x50 Call Trace: qla2x00_async_sns_sp_done+0x107/0x1b0 [qla2xxx] qla2x00_abort_srb+0x8e/0x250 [qla2xxx] ? ql_dbg+0x70/0x100 [qla2xxx] __qla2x00_abort_all_cmds+0x108/0x190 [qla2xxx] qla2x00_abort_all_cmds+0x24/0x70 [qla2xxx] qla2x00_abort_isp_cleanup+0x305/0x3e0 [qla2xxx] qla2x00_remove_one+0x364/0x400 [qla2xxx] pci_device_remove+0x36/0xa0 __device_release_driver+0x17a/0x230 device_release_driver+0x24/0x30 pci_stop_bus_device+0x68/0x90 pci_stop_and_remove_bus_device_locked+0x16/0x30 remove_store+0x75/0x90 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 ? do_user_addr_fault+0x1d8/0x680 ? do_syscall_64+0x69/0x80 ? exc_page_fault+0x62/0x140 ? asm_exc_page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x44/0xae The command was completed in the abort path during driver unload with a lock held, causing the warning in abort path. Hence complete the command without any lock held.
Quoted source text, attributed separately from HOL analysis.