CVE-2023-54011: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54011 is a vulnerability in the Linux kernel's scsi: mpi3mr driver, identified and resolved after detection by KASAN (Kernel Address Sanitizer). The flaw involves writing 64 bytes where only 32 bytes are correct, constituting an out-of-bounds write issue. It was published on December 24, 2025, and affects Linux kernel versions in the range introduced by commit 42fc9fee116fc6a225a1f738adf86689d5c39d49. No CVSS score has been assigned by NVD at this time, and the EPSS score is extremely low at 0.000170 (Feedly, EUVD).

The root cause is an incorrect buffer write size in the mpi3mr SCSI driver within the Linux kernel — specifically, 64 bytes are written where only 32 bytes should be, which can result in a heap or stack out-of-bounds write (consistent with CWE-787: Out-of-bounds Write). The issue was surfaced by KASAN, a dynamic memory error detector built into the Linux kernel. Patches were applied across multiple stable branches, with fixes committed at abfe73c16b, ae7d45f5283d, and c8755f913a2f (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3).

Exploitation of this vulnerability could lead to kernel memory corruption due to the oversized write in the mpi3mr SCSI driver. Depending on the memory layout at the time of the write, this could result in system instability, kernel panics (denial of service), or potentially privilege escalation if an attacker can control the conditions under which the driver operates. The impact is limited to systems using the mpi3mr driver (Broadcom MPI3 SAS/PCIe controller), reducing the affected asset scope (Feedly).

Apply the upstream Linux kernel patches that correct the write size in the mpi3mr driver. Fixed commits are available for multiple stable branches: abfe73c16b (patch for 6.3+), c8755f913a2f (patch for 6.2.5+), and ae7d45f5283d (patch for 6.1.18+). Users should update to a patched kernel version as provided by their Linux distribution. Systems not using Broadcom MPI3-based SAS/PCIe controllers are not affected (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3).