CVE-2023-53530 Details
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id() The following call trace was observed: localhost kernel: nvme nvme0: NVME-FC{0}: controller connect complete localhost kernel: BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u129:4/75092 localhost kernel: nvme nvme0: NVME-FC{0}: new ctrl: NQN "nqn.1992-08.com.netapp:sn.b42d198afb4d11ecad6d00a098d6abfa:subsystem.PR_Channel2022_RH84_subsystem_291" localhost kernel: caller is qla_nvme_post_cmd+0x216/0x1380 [qla2xxx] localhost kernel: CPU: 6 PID: 75092 Comm: kworker/u129:4 Kdump: loaded Tainted: G B W OE --------- --- 5.14.0-70.22.1.el9_0.x86_64+debug #1 localhost kernel: Hardware name: HPE ProLiant XL420 Gen10/ProLiant XL420 Gen10, BIOS U39 01/13/2022 localhost kernel: Workqueue: nvme-wq nvme_async_event_work [nvme_core] localhost kernel: Call Trace: localhost kernel: dump_stack_lvl+0x57/0x7d localhost kernel: check_preemption_disabled+0xc8/0xd0 localhost kernel: qla_nvme_post_cmd+0x216/0x1380 [qla2xxx] Use raw_smp_processor_id() instead of smp_processor_id(). Also use queue_work() across the driver instead of queue_work_on() thus avoiding usage of smp_processor_id() when CONFIG_DEBUG_PREEMPT is enabled.
A vulnerability in the Linux kernel's QLA2XXX SCSI driver has been addressed. The issue involved the use of 'smp_processor_id()' in preemptible code, which can lead to incorrect behavior in a multi-threaded environment. This vulnerability was observed in the NVMe over Fibre Channel (NVME-FC) controller connection process, where the QLA2XXX driver improperly handled processor ID retrieval. The problem has been fixed by replacing 'smp_processor_id()' with 'raw_smp_processor_id()', ensuring accurate processor identification without the risk of preemption interference. Additionally, the driver has been updated to use 'queue_work()' instead of 'queue_work_on()', further mitigating the issue by avoiding 'smp_processor_id()' usage when debugging preemption is enabled.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/1a541999f31fcb10ea50eba2a563e6c451fd5c7d | kernel.org | Patch |
| https://git.kernel.org/stable/c/25bd0c7def04a272f8e89b36971712fe29c6e438 | kernel.org | Patch |
| https://git.kernel.org/stable/c/52c7b41ad6ee53222f4ee2f0c099a6ed8291a168 | kernel.org | Patch |
| https://git.kernel.org/stable/c/59f10a05b5c7b675256a66e3161741239889ff80 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.3, < 6.5.5 6.6 rc1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Mar 25, 2026 | Modified Analysis | [email protected] |
| Jan 27, 2026 | Initial Analysis | [email protected] |
| Oct 1, 2025 | New CVE Received | kernel.org |