CVE-2023-53387: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53387 affects the Linux kernel and involves a vulnerability in the SCSI UFS core component. The issue was discovered and reported to the kernel.org team, with the vulnerability being publicly disclosed on September 18, 2025 (NVD).

The vulnerability occurs in the UFS error handling flow where the host sends a device management command (NOP OUT) to the device for link recovery. If this command times out and clearing the doorbell fails, the ufshcdwaitfordevcmd() function returns without setting the hba->devcmd.complete struct to NULL. When the command is later completed by the device, complete() is called in _ufshcdtransferreq_compl(), leading to a crash due to the complete struct being allocated on the stack (Debian Security).

The vulnerability can result in system crashes when specific conditions in the UFS error handling flow are met, potentially affecting system stability and availability. The issue primarily impacts systems using UFS storage devices with the affected Linux kernel versions.

The vulnerability has been fixed in various Linux distributions and kernel versions. Debian has implemented fixes in bookworm (6.1.148-1), bookworm security (6.1.153-1), trixie (6.12.43-1), trixie security (6.12.48-1), forky (6.16.8-1), and sid (6.16.9-1) releases (Debian Security).