CVE-2023-54184

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace: Time2Retain timer expired for SID: 1, cleaning up iSCSI session. BUG: kernel NULL pointer dereference, address: 0000000000000140 RIP: 0010:sbitmap_queue_clear+0x3a/0xa0 Call Trace: target_release_cmd_kref+0xd1/0x1f0 [target_core_mod] transport_generic_free_cmd+0xd1/0x180 [target_core_mod] iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod] iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod] iscsit_close_session+0x13a/0x140 [iscsi_target_mod] iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod] call_timer_fn+0x24/0x140 Move cleanup of recovery enrties to before session freeing.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux SIG Cloud 8.10 Release Notes linked from the References section.

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace: Time2Retain timer expired for SID: 1, cleaning up iSCSI session. BUG: kernel NULL pointer dereference, address: 0000000000000140 RIP: 0010:sbitmap_queue_clear+0x3a/0xa0 Call Trace: target_release_cmd_kref+0xd1/0x1f0 [target_core_mod] transport_generic_free_cmd+0xd1/0x180 [target_core_mod] iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod] iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod] iscsit_close_session+0x13a/0x140 [iscsi_target_mod] iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod] call_timer_fn+0x24/0x140 Move cleanup of recovery enrties to before session freeing.

• fix: fbdev: fix potential buffer overflow in do_register_framebuffer()
• qed: Don't collect too many protection override GRC elements {CVE-2025-39949}
• drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693}
• pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691}
• netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732}
• ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
• fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
• svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811}
• bpf: Disable preemption in bpf_perf_event_output {CVE-2023-54303}
• scsi: target: iscsit: Free cmds before session free {CVE-2023-54184}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• memcg: protect concurrent access to mem_cgroup_idr {CVE-2024-43892}
• ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
• KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
• net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
• net: tls: avoid hanging tasks on the tx_lock {CVE-2023-54306}
• usb: typec: bus: verify partner exists in typec_altmode_attention {CVE-2023-54299}
• scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization {CVE-2023-54234}
• rxrpc: Fix timeout of a call that hasn't yet been granted a channel {CVE-2023-54195}
• block, bfq: Fix division by zero error on zero wsum {CVE-2023-54242}
• wifi: cfg80211: reject auth/assoc to AP with our address {CVE-2023-53540}
• wifi: iwlwifi: mvm: don't trust firmware n_channels {CVE-2023-53589}
• wifi: mac80211: check for station first in client probe {CVE-2023-53588}
• bonding: do not assume skb mac_header is set {CVE-2023-53601}
• drm/i915: Make intel_get_crtc_new_encoder() less oopsy {CVE-2023-53571}
• wifi: rtw88: delete timer and free skb queue when unloading {CVE-2023-53574}
• net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
• media: uvcvideo: Fix memory leak in uvc_gpio_parse {CVE-2022-50882}
• md/raid10: fix memleak of md thread {CVE-2023-54294}
• usb: typec: altmodes/displayport: fix pin_assignment_show {CVE-2023-54186}
• scsi: qedf: Fix NULL dereference in error handling {CVE-2023-54289}
• HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53125}
• rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() {CVE-2023-54246}
• bpf: Address KCSAN report on bpf_lru_list {CVE-2023-54283}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
• drm/i915: fix race condition UAF in i915_perf_add_config_ioctl {CVE-2023-54202}
• mmc: via-sdmmc: fix return value check of mmc_add_host() {CVE-2022-50846}
• bpf: Disable preemption in bpf_event_output {CVE-2023-54173}
• net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
• net/mlx5: Handle pairing of E-switch via uplink un/load APIs {CVE-2023-53347}
• net/mlx5e: Fix cleanup null-ptr deref on encap lock {CVE-2023-53105}
• smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
• perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• HID: core: ensure __hid_request reserves the report ID as the first byte
• HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
• HID: intel-ish-hid: Fix kernel panic during warm reset {CVE-2023-53392}
• xfs: do not propagate ENODATA…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50453: gpiolib: cdev: fix NULL-pointer dereferences (bsc#1250887).
• CVE-2023-53794: cifs: fix session state check in reconnect to avoid use-after-free issue (bsc#1255163).
• CVE-2023-53802: wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function (bsc#1254725).
• CVE-2023-53808: wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (bsc#1254723).
• CVE-2023-53816: drm/amdkfd: fix potential kgd_mem UAFs (bsc#1254958).
• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2023-53827: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (bsc#1255049).
• CVE-2023-54184: scsi: target: iscsit: Free cmds before session free (bsc#1255991).
• CVE-2025-21738: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (bsc#1238917).
• CVE-2025-22083: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (bsc#1241414).
• CVE-2025-22125: md/raid1,raid10: do not ignore IO flags (bsc#1241596).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40219: PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (bsc#1254518).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40342: nvme-fc: use lock accessing port_state and rport state (bsc#1255274).
• CVE-2025-68223: drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (bsc#1255357).
• CVE-2025-68234: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68287: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (bsc#1255152).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68724: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (bsc#1255550).
• CVE-2025-68818: scsi: qla2xxx: Perform lockless command completion in abort path (bsc#1256675).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
• CVE-2025-71131: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (bsc#1256742).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71224: wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (bsc#1258824).
• CVE-2025-71236: scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1258442).
• CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).
• CVE-2026-22998: nvme-tcp: fix NULL…