GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53387 (GCVE-0-2023-53387)

Vulnerability from cvelistv5 – Published: 2025-09-18 13:33 – Updated: 2026-08-05 09:13
VLAI
Title
scsi: ufs: core: Fix device management cmd timeout flow
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix device management cmd timeout flow In the UFS error handling flow, the host will send a device management cmd (NOP OUT) to the device for link recovery. If this cmd times out and clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and return. hba->dev_cmd.complete struct is not set to NULL. When this happens, if cmd has been completed by device, then we will call complete() in __ufshcd_transfer_req_compl(). Because the complete struct is allocated on the stack, the following crash will occur: ipanic_die+0x24/0x38 [mrdump] die+0x344/0x748 arm64_notify_die+0x44/0x104 do_debug_exception+0x104/0x1e0 el1_dbg+0x38/0x54 el1_sync_handler+0x40/0x88 el1_sync+0x8c/0x140 queued_spin_lock_slowpath+0x2e4/0x3c0 __ufshcd_transfer_req_compl+0x3b0/0x1164 ufshcd_trc_handler+0x15c/0x308 ufshcd_host_reset_and_restore+0x54/0x260 ufshcd_reset_and_restore+0x28c/0x57c ufshcd_err_handler+0xeb8/0x1b6c process_one_work+0x288/0x964 worker_thread+0x4bc/0xc7c kthread+0x15c/0x264 ret_from_fork+0x10/0x30
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 18:58 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f5c2976e0cb0f6236013bfb479868531b04f61d4 , < cf45493432704786a0f8294c7723ad4eeb5fff24 (git)
Affected: f5c2976e0cb0f6236013bfb479868531b04f61d4 , < 3ffd2cd644e0f1eea01339831bac4b1054e8817c (git)
Affected: f5c2976e0cb0f6236013bfb479868531b04f61d4 , < 36822124f9de200cedc2f42516301b50d386a6cd (git)
Affected: 8841c1b02c8083e4451077a2b1f235bbfd0db105 (git)
Affected: 5.18.16 , < 5.19 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.16 , ≤ 6.1.* (semver)
Unaffected: 6.2.3 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:58:04.971450Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:03:05.063Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cf45493432704786a0f8294c7723ad4eeb5fff24",
              "status": "affected",
              "version": "f5c2976e0cb0f6236013bfb479868531b04f61d4",
              "versionType": "git"
            },
            {
              "lessThan": "3ffd2cd644e0f1eea01339831bac4b1054e8817c",
              "status": "affected",
              "version": "f5c2976e0cb0f6236013bfb479868531b04f61d4",
              "versionType": "git"
            },
            {
              "lessThan": "36822124f9de200cedc2f42516301b50d386a6cd",
              "status": "affected",
              "version": "f5c2976e0cb0f6236013bfb479868531b04f61d4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8841c1b02c8083e4451077a2b1f235bbfd0db105",
              "versionType": "git"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.16",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.3",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix device management cmd timeout flow\n\nIn the UFS error handling flow, the host will send a device management cmd\n(NOP OUT) to the device for link recovery. If this cmd times out and\nclearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and\nreturn. hba-\u003edev_cmd.complete struct is not set to NULL.\n\nWhen this happens, if cmd has been completed by device, then we will call\ncomplete() in __ufshcd_transfer_req_compl(). Because the complete struct is\nallocated on the stack, the following crash will occur:\n\n  ipanic_die+0x24/0x38 [mrdump]\n  die+0x344/0x748\n  arm64_notify_die+0x44/0x104\n  do_debug_exception+0x104/0x1e0\n  el1_dbg+0x38/0x54\n  el1_sync_handler+0x40/0x88\n  el1_sync+0x8c/0x140\n  queued_spin_lock_slowpath+0x2e4/0x3c0\n  __ufshcd_transfer_req_compl+0x3b0/0x1164\n  ufshcd_trc_handler+0x15c/0x308\n  ufshcd_host_reset_and_restore+0x54/0x260\n  ufshcd_reset_and_restore+0x28c/0x57c\n  ufshcd_err_handler+0xeb8/0x1b6c\n  process_one_work+0x288/0x964\n  worker_thread+0x4bc/0xc7c\n  kthread+0x15c/0x264\n  ret_from_fork+0x10/0x30"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the UFS host controller core (`ufshcd_wait_for_dev_cmd` / `ufshcd_exec_dev_cmd`), reached via local storage I/O that drives the SCSI/UFS error handler, or via local `/dev/ufs-bsg` UPIU submission. UFS is onboard soldered flash with no network or adjacent-protocol exposure.\nAC:L - A local attacker can force the error-recovery path with sustained/deep-queue I/O that times out commands; during link recovery the NOP OUT commonly times out and doorbell clear fails when the link/device is unhealthy (as in the reported MediaTek crash), after which the dangling `complete()` is deterministic and retryable.\nPR:L - An ordinary local account with access to UFS-backed storage can generate I/O that enters `ufshcd_err_handler` \u2192 `ufshcd_reset_and_restore` \u2192 `ufshcd_verify_dev_init` without root, CAP_SYS_RAWIO, or init-namespace privileges, matching other scored UFS EH bugs.\nUI:N - The vulnerable wait/complete sequence runs entirely inside the kernel UFS error-handler workqueue in response to the attacker\u2019s own I/O; no separate victim mount, open, or interactive action is required.\nS:U - The dangling stack completion and resulting corruption stay inside the host kernel that owns the UFS controller; no VM escape, IOMMU bypass, or sandbox boundary is crossed.\nC:H - This is a use-after-free of the stack-allocated `struct completion`: after `ufshcd_exec_dev_cmd` returns, `complete(hba-\u003edev_cmd.complete)` still runs and `swake_up_locked()` walks the reused `wait.task_list`, which with stack-frame reuse is a UAF read/wake primitive over kernel memory.\nI:H - `complete()` writes `done++` and takes/releases the wait-queue spinlock on the freed stack slot, so subsequent frames\u2019 locals are corrupted; a forged wait-queue on that reused stack yields the classic completion/wait-queue write primitive usable for control-flow hijack.\nA:H - The reported failure is an unrecoverable kernel die in `queued_spin_lock_slowpath` from `__ufshcd_transfer_req_compl` during `ufshcd_err_handler`, panicking or hanging the system\u2019s storage stack."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:13:50.499Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cf45493432704786a0f8294c7723ad4eeb5fff24"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ffd2cd644e0f1eea01339831bac4b1054e8817c"
        },
        {
          "url": "https://git.kernel.org/stable/c/36822124f9de200cedc2f42516301b50d386a6cd"
        }
      ],
      "title": "scsi: ufs: core: Fix device management cmd timeout flow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53387",
    "datePublished": "2025-09-18T13:33:30.635Z",
    "dateReserved": "2025-09-17T14:54:09.737Z",
    "dateUpdated": "2026-08-05T09:13:50.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53387",
      "date": "2026-09-18",
      "epss": "0.00151",
      "percentile": "0.04656"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/ufs/core/ufshcd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cf45493432704786a0f8294c7723ad4eeb5fff24",
                    "status": "affected",
                    "version": "f5c2976e0cb0f6236013bfb479868531b04f61d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3ffd2cd644e0f1eea01339831bac4b1054e8817c",
                    "status": "affected",
                    "version": "f5c2976e0cb0f6236013bfb479868531b04f61d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "36822124f9de200cedc2f42516301b50d386a6cd",
                    "status": "affected",
                    "version": "f5c2976e0cb0f6236013bfb479868531b04f61d4",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "8841c1b02c8083e4451077a2b1f235bbfd0db105",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "affected",
                    "version": "5.18.16",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/ufs/core/ufshcd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9C09D685-E69A-4F9A-B1EC-9CD7CC8BA62A",
                    "versionEndExcluding": "6.1.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "88C67289-22AD-4CA9-B202-5F5A80E5BA4B",
                    "versionEndExcluding": "6.2.3",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix device management cmd timeout flow\n\nIn the UFS error handling flow, the host will send a device management cmd\n(NOP OUT) to the device for link recovery. If this cmd times out and\nclearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and\nreturn. hba-\u003edev_cmd.complete struct is not set to NULL.\n\nWhen this happens, if cmd has been completed by device, then we will call\ncomplete() in __ufshcd_transfer_req_compl(). Because the complete struct is\nallocated on the stack, the following crash will occur:\n\n  ipanic_die+0x24/0x38 [mrdump]\n  die+0x344/0x748\n  arm64_notify_die+0x44/0x104\n  do_debug_exception+0x104/0x1e0\n  el1_dbg+0x38/0x54\n  el1_sync_handler+0x40/0x88\n  el1_sync+0x8c/0x140\n  queued_spin_lock_slowpath+0x2e4/0x3c0\n  __ufshcd_transfer_req_compl+0x3b0/0x1164\n  ufshcd_trc_handler+0x15c/0x308\n  ufshcd_host_reset_and_restore+0x54/0x260\n  ufshcd_reset_and_restore+0x28c/0x57c\n  ufshcd_err_handler+0xeb8/0x1b6c\n  process_one_work+0x288/0x964\n  worker_thread+0x4bc/0xc7c\n  kthread+0x15c/0x264\n  ret_from_fork+0x10/0x30"
          }
        ],
        "id": "CVE-2023-53387",
        "lastModified": "2026-08-04T10:19:05.103",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-53387",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:58:04.971450Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-18T14:15:41.767",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/36822124f9de200cedc2f42516301b50d386a6cd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3ffd2cd644e0f1eea01339831bac4b1054e8817c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cf45493432704786a0f8294c7723ad4eeb5fff24"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-21T19:12:06+00:00",
      "cve": "CVE-2023-53387",
      "id": "CVE-2023-53387",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service in UFS subsystem",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53387.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:30:49Z",
      "cve": "CVE-2023-53387",
      "id": "CVE-2023-53387",
      "initial_release_date": "2025-09-22T23:40:29Z",
      "product_status:known_affected": "330",
      "product_status:known_not_affected": "155",
      "product_status:recommended": "29",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53387",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53387.json",
      "version": "14"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-53387",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-14T18:58:04.971450Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "description": "CWE-noinfo Not enough information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-14T18:57:59.402Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/ufs/core/ufshcd.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "cf45493432704786a0f8294c7723ad4eeb5fff24",
                  "status": "affected",
                  "version": "f5c2976e0cb0f6236013bfb479868531b04f61d4",
                  "versionType": "git"
                },
                {
                  "lessThan": "3ffd2cd644e0f1eea01339831bac4b1054e8817c",
                  "status": "affected",
                  "version": "f5c2976e0cb0f6236013bfb479868531b04f61d4",
                  "versionType": "git"
                },
                {
                  "lessThan": "36822124f9de200cedc2f42516301b50d386a6cd",
                  "status": "affected",
                  "version": "f5c2976e0cb0f6236013bfb479868531b04f61d4",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "8841c1b02c8083e4451077a2b1f235bbfd0db105",
                  "versionType": "git"
                },
                {
                  "lessThan": "5.19",
                  "status": "affected",
                  "version": "5.18.16",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/ufs/core/ufshcd.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.19"
                },
                {
                  "lessThan": "5.19",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.16",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.2.*",
                  "status": "unaffected",
                  "version": "6.2.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.3",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.16",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.2.3",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.3",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.18.16",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix device management cmd timeout flow\n\nIn the UFS error handling flow, the host will send a device management cmd\n(NOP OUT) to the device for link recovery. If this cmd times out and\nclearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and\nreturn. hba-\u003edev_cmd.complete struct is not set to NULL.\n\nWhen this happens, if cmd has been completed by device, then we will call\ncomplete() in __ufshcd_transfer_req_compl(). Because the complete struct is\nallocated on the stack, the following crash will occur:\n\n  ipanic_die+0x24/0x38 [mrdump]\n  die+0x344/0x748\n  arm64_notify_die+0x44/0x104\n  do_debug_exception+0x104/0x1e0\n  el1_dbg+0x38/0x54\n  el1_sync_handler+0x40/0x88\n  el1_sync+0x8c/0x140\n  queued_spin_lock_slowpath+0x2e4/0x3c0\n  __ufshcd_transfer_req_compl+0x3b0/0x1164\n  ufshcd_trc_handler+0x15c/0x308\n  ufshcd_host_reset_and_restore+0x54/0x260\n  ufshcd_reset_and_restore+0x28c/0x57c\n  ufshcd_err_handler+0xeb8/0x1b6c\n  process_one_work+0x288/0x964\n  worker_thread+0x4bc/0xc7c\n  kthread+0x15c/0x264\n  ret_from_fork+0x10/0x30"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The bug is in the UFS host controller core (`ufshcd_wait_for_dev_cmd` / `ufshcd_exec_dev_cmd`), reached via local storage I/O that drives the SCSI/UFS error handler, or via local `/dev/ufs-bsg` UPIU submission. UFS is onboard soldered flash with no network or adjacent-protocol exposure.\nAC:L - A local attacker can force the error-recovery path with sustained/deep-queue I/O that times out commands; during link recovery the NOP OUT commonly times out and doorbell clear fails when the link/device is unhealthy (as in the reported MediaTek crash), after which the dangling `complete()` is deterministic and retryable.\nPR:L - An ordinary local account with access to UFS-backed storage can generate I/O that enters `ufshcd_err_handler` \u2192 `ufshcd_reset_and_restore` \u2192 `ufshcd_verify_dev_init` without root, CAP_SYS_RAWIO, or init-namespace privileges, matching other scored UFS EH bugs.\nUI:N - The vulnerable wait/complete sequence runs entirely inside the kernel UFS error-handler workqueue in response to the attacker\u2019s own I/O; no separate victim mount, open, or interactive action is required.\nS:U - The dangling stack completion and resulting corruption stay inside the host kernel that owns the UFS controller; no VM escape, IOMMU bypass, or sandbox boundary is crossed.\nC:H - This is a use-after-free of the stack-allocated `struct completion`: after `ufshcd_exec_dev_cmd` returns, `complete(hba-\u003edev_cmd.complete)` still runs and `swake_up_locked()` walks the reused `wait.task_list`, which with stack-frame reuse is a UAF read/wake primitive over kernel memory.\nI:H - `complete()` writes `done++` and takes/releases the wait-queue spinlock on the freed stack slot, so subsequent frames\u2019 locals are corrupted; a forged wait-queue on that reused stack yields the classic completion/wait-queue write primitive usable for control-flow hijack.\nA:H - The reported failure is an unrecoverable kernel die in `queued_spin_lock_slowpath` from `__ufshcd_transfer_req_compl` during `ufshcd_err_handler`, panicking or hanging the system\u2019s storage stack."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T09:13:50.499Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/cf45493432704786a0f8294c7723ad4eeb5fff24"
            },
            {
              "url": "https://git.kernel.org/stable/c/3ffd2cd644e0f1eea01339831bac4b1054e8817c"
            },
            {
              "url": "https://git.kernel.org/stable/c/36822124f9de200cedc2f42516301b50d386a6cd"
            }
          ],
          "title": "scsi: ufs: core: Fix device management cmd timeout flow",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-53387",
        "datePublished": "2025-09-18T13:33:30.635Z",
        "dateReserved": "2025-09-17T14:54:09.737Z",
        "dateUpdated": "2026-08-05T09:13:50.499Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.