CVE-2023-53322: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53322 is a use-after-free (UAF) vulnerability in the Linux kernel's SCSI qla2xxx driver, specifically in the terminate_rport_io function. The flaw allows the function to exit before ensuring all in-flight I/Os have returned, leaving the driver holding references to already-freed resources and causing a system crash. It affects multiple Linux kernel stable branches: versions before 4.14.322, 4.15–4.19.291, 4.20–5.4.251, 5.5–5.10.188, 5.11–5.15.121, 5.16–6.1.40, and 6.2–6.4.5. The vulnerability was published on September 16, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Feedly).

The root cause is a race condition in the terminate_rport_io callback of the qla2xxx Fibre Channel HBA driver (CWE-416: Use After Free). For FCP-2 devices, I/Os can remain pending in hardware because the driver does not tear down the firmware session at the first sign of a cable pull. When the dev_loss_tmo timer fires, terminate_rport_io is called and the upper SCSI layer begins freeing resources; however, the qla2xxx cleanup path may not complete in time, leaving the driver accessing already-freed memory. The fix ensures the driver waits for all I/Os to return to the upper layer before resources are released (Red Hat CVE, kernel.org patches). Exploitation requires local access with low privileges (PR:L), and no network exposure is involved.

Successful exploitation can cause a kernel panic (system crash), resulting in a complete loss of availability for the affected host. Because the vulnerability involves accessing freed kernel memory, there is also a theoretical risk of arbitrary kernel code execution, which could compromise confidentiality and integrity of all data on the system. The scope is limited to the local machine running a vulnerable kernel with the qla2xxx driver active, but a kernel-level compromise could enable full privilege escalation and lateral movement within an environment (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The local attack vector and requirement for low-privilege access further limit the practical exploitability of this flaw.

The primary remediation is to update to a patched Linux kernel version. Fixed versions are available across all affected stable branches: 4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.40, 6.4.5, and 6.5 (Red Hat CVE, Feedly). Red Hat has issued errata (e.g., RHSA-2025:22072, RHSA-2025:23422, RHSA-2025:23947, RHSA-2026:0536, RHSA-2026:0643) for affected RHEL versions (Red Hat Errata). SUSE and Oracle Linux have also released corresponding kernel updates. For systems that cannot be immediately patched, consider restricting local user access, disabling the qla2xxx module if Fibre Channel HBAs are not in use, and applying additional kernel hardening controls.