CVE-2023-53510: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53510 is a double-free vulnerability in the Linux kernel's UFS (Universal Flash Storage) subsystem, specifically in the SCSI command handling logic within drivers/ufs/core/ufshcd.c. The flaw arises because ufshcd_queuecommand() may be called twice in succession for a SCSI command before it completes, leading to improper handling of the lrbp->cmd pointer. It affects Linux kernel versions 3.12 through 6.3.12 and 6.4.0 through 6.4.3. The CVE was published on October 1, 2025, with NIST's initial analysis completed on January 26, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, NVD).

The vulnerability is classified as CWE-415 (Double Free), rooted in improper lifecycle management of the lrbp->cmd pointer in the UFS host controller driver. When a SCSI command times out and the error handler invokes scsi_send_eh_cmnd(), ufshcd_queuecommand() can be called a second time for the same command before completion; the prior code incorrectly checked and cleared lrbp->cmd in error paths and in ufshcd_release_scsi_cmd(), creating a double-free condition. The fix modifies these functions to neither check the old value of lrbp->cmd nor clear it in error paths or during release, preventing the kernel warning and associated memory corruption. Exploitation requires local access with low privileges on a system using UFS storage devices (Feedly, NVD).

Successful exploitation of this vulnerability by a local, low-privileged attacker could result in high impact to confidentiality, integrity, and availability of the affected system. The double-free condition in the kernel's UFS storage subsystem can lead to kernel memory corruption, system instability, kernel panics, or potential privilege escalation depending on how the freed memory is subsequently reused. Systems relying on UFS storage (common in mobile and embedded Linux devices) are particularly at risk of data integrity issues and denial of service (Feedly, NVD).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log referencing WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8 with an associated call trace including scsi_send_eh_cmnd, scsi_eh_test_devices, scsi_eh_ready_devs, scsi_error_handler, and kthread.
• Process: Unusual activity or hangs in the scsi_error_handler kernel thread, particularly on systems with UFS storage devices experiencing command timeouts.
• System: Unexpected kernel panics or system instability on devices using UFS storage, especially following SCSI command timeout events.

Patches are available in Linux kernel versions 6.3.13 and 6.4.4, as well as in kernel 6.5 and later. Four upstream fix commits have been identified: 49234a401e16, 549e91a9bbaa, f3ee24af6268, and b6d76d63c6d2. Administrators should update to a patched kernel version as the primary remediation. As a temporary workaround, minimizing conditions that trigger repeated SCSI command submissions and timeouts on UFS devices may reduce exposure until patching is feasible. Debian has issued advisories (DSA-6243-1 and DLA-4561-1) addressing this vulnerability in their kernel packages (Feedly, NVD).

Debian issued security advisories DSA-6243-1 and DLA-4561-1 addressing this and related Linux kernel vulnerabilities, indicating downstream distribution uptake of the fix. Detection coverage has been added by Qualys (detection IDs 759780, 759860) and Tenable Nessus (plugin 311783). No notable researcher commentary or significant social media discussion has been observed for this vulnerability (Feedly).