CVE-2023-54100: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54100 is a use-after-free vulnerability in the Linux kernel's SCSI qedi (QLogic iSCSI) driver, specifically in the qedi_remove() function. The flaw arises from a race condition where deferred work items (recovery_work and board_disable_work) may access already-freed memory during driver removal. It affects Linux kernel versions from the introduction of the qedi driver up to the fixes applied in stable releases including 5.10.180, 5.15.112, 6.1.29, 6.2.16, 6.3.3, and 6.4. The vulnerability was published on December 24, 2025, and carries an EPSS score of approximately 0.024% (Feedly).

The root cause is a use-after-free condition (CWE-416) in the Linux kernel's drivers/scsi/qedi/ subsystem. During driver initialization in qedi_probe(), two delayed work items are registered: recovery_work (handled by qedi_recovery_handler()) and board_disable_work (handled by qedi_board_disable_work()). When qedi_remove() is called concurrently while qedi_recovery_handler() is executing on another CPU, __qedi_remove() can free the iSCSI host structure (shost) via iscsi_host_free()/scsi_host_put() before iscsi_host_for_each_session() in the recovery handler finishes accessing qedi->shost, resulting in a use-after-free. The fix cancels both recovery_work and board_disable_work in __qedi_remove() before proceeding with cleanup (Feedly, Kernel Patch).

Successful exploitation of this vulnerability could lead to kernel memory corruption, system crashes (kernel panic), or potentially privilege escalation depending on the attacker's ability to control freed memory contents. The vulnerability is local in nature, requiring the ability to trigger driver removal (e.g., via physical device removal or privileged operations) while a recovery handler is concurrently executing. The primary availability impact is a kernel crash; integrity and confidentiality impacts are theoretically possible if the freed memory is reallocated and manipulated, but exploitation for code execution would be highly complex (Feedly).

The fix has been backported to multiple Linux stable kernel branches. Users should upgrade to the following patched versions or later: Linux 5.10.180, 5.15.112, 6.1.29, 6.2.16, 6.3.3, or 6.4. The fix cancels recovery_work and board_disable_work in __qedi_remove() before any cleanup proceeds, eliminating the race condition. Linux distribution vendors (Red Hat, etc.) are expected to incorporate these fixes into their respective kernel packages; users should apply available distribution updates promptly (Feedly, Kernel Patch).