{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b6d76d63c6d21d5d26c301a46853a2aee72397d5",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            },
            {
              "lessThan": "f3ee24af62681b942bbd799ac77b90a6d7e1fdb1",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            },
            {
              "lessThan": "49234a401e161a2f2698f4612ab792c49b3cad1b",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            },
            {
              "lessThan": "549e91a9bbaa0ee480f59357868421a61d369770",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.13",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.4",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix handling of lrbp-\u003ecmd\n\nufshcd_queuecommand() may be called two times in a row for a SCSI command\nbefore it is completed. Hence make the following changes:\n\n - In the functions that submit a command, do not check the old value of\n   lrbp-\u003ecmd nor clear lrbp-\u003ecmd in error paths.\n\n - In ufshcd_release_scsi_cmd(), do not clear lrbp-\u003ecmd.\n\nSee also scsi_send_eh_cmnd().\n\nThis commit prevents that the following appears if a command times out:\n\nWARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8\nCall trace:\n ufshcd_queuecommand+0x6f8/0x9a8\n scsi_send_eh_cmnd+0x2c0/0x960\n scsi_eh_test_devices+0x100/0x314\n scsi_eh_ready_devs+0xd90/0x114c\n scsi_error_handler+0x2b4/0xb70\n kthread+0x16c/0x1e0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The affected code is the UFS host controller core driver, reached by submitting SCSI commands to local storage (filesystem I/O, SG_IO on the block device, or /dev/ufs-bsg) and by the kernel SCSI error handler that runs on top of them. There is no network or adjacent-network exposure, and no physical device attachment is needed since UFS is internal soldered storage.\nAC:L - A local attacker drives both halves of the sequence: they queue commands that stall the device (SG_IO lets the caller pick the command timeout, and queue saturation or long-running opcodes reliably produce timeouts), which forces scsi_send_eh_cmnd() to re-submit the same scsi_cmnd at the same tag, and the WARN_ON plus descriptor/PRDT rewrite then follow deterministically. Nothing in the trigger depends on state the attacker cannot influence, and the attempt can be repeated indefinitely.\nPR:L - Only an ordinary local account is needed \u2014 any user generating I/O against UFS-backed storage can have commands in flight that time out, and SG_IO on a readable block device (shell users on embedded/kiosk devices, `disk`-group members) lets the attacker choose the command timeout directly. No root, CAP_SYS_RAWIO, or namespace privilege is required to reach ufshcd_queuecommand() and the SCSI error handler path.\nUI:N - The SCSI error handler thread escalates and re-issues the command automatically once a timeout fires; no victim needs to mount a filesystem, open a file, or take any other action. The attacker\u0027s own I/O is sufficient.\nS:U - The corrupted state (lrbp-\u003ecmd, the transfer request descriptor, PRDT, DMA mappings, hba-\u003edev_cmd.complete) and all resulting damage stay inside the kernel that owns the UFS controller. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Re-programming a transfer descriptor for a tag that is still in the controller doorbell mis-routes completions, so one command\u0027s response UPIU and sense data are delivered as another command\u0027s result, and the spurious complete(hba-\u003edev_cmd.complete) makes ufshcd_wait_for_dev_cmd() read hba-\u003edev_cmd.cqe and lrbp-\u003eucd_rsp_ptr while the controller is still writing them. Combined with the orphaned DMA mapping that leaves the device able to read pages after they are freed and reused, this yields disclosure of arbitrary kernel memory contents.\nI:H - ufshcd_map_sg() calls scsi_dma_map() a second time and rewrites the PRDT for a tag the controller is actively executing, and ufshcd_release_scsi_cmd() unmaps only one of the two mappings \u2014 leaving the UFS controller with DMA write access to pages that are subsequently freed and reallocated. Device-driven writes into reused kernel memory, plus the recycled device-management reserved slot being reprogrammed under an in-flight transfer, constitute kernel memory corruption usable for control-flow hijack.\nA:H - The documented symptom is a WARNING at ufshcd.c:2965 in ufshcd_queuecommand() from the SCSI error handler, which is an immediate kernel panic on the panic_on_warn configurations used by Android GKI, ChromeOS, and hardened embedded builds. Even without panic_on_warn, the descriptor/doorbell confusion and the falsely completed device-management command wedge the UFS error handler and the system\u0027s only storage device."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:32.898Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b6d76d63c6d21d5d26c301a46853a2aee72397d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3ee24af62681b942bbd799ac77b90a6d7e1fdb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/49234a401e161a2f2698f4612ab792c49b3cad1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/549e91a9bbaa0ee480f59357868421a61d369770"
        }
      ],
      "title": "scsi: ufs: core: Fix handling of lrbp-\u003ecmd",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53510",
    "datePublished": "2025-10-01T11:45:59.421Z",
    "dateReserved": "2025-10-01T11:39:39.405Z",
    "dateUpdated": "2026-08-05T09:14:32.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}