CVE-2023-54108: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54108 is a kernel bug in the Linux qla2xxx SCSI driver related to improper DMA API usage during NVMe Link Service (LS) request handling. The flaw causes a DMA-API warning/call trace on debug kernels because the driver attempts to unmap a DMA mapping that is already managed by the Fibre Channel (FC) layer, resulting in a double-unmap condition. It affects multiple stable Linux kernel branches, with fixes backported to versions 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. The vulnerability was published on December 24, 2025, and carries a CVSS base score of 0.0 (no direct security impact scored) (ENISA EUVD).

The root cause is an improper DMA mapping management in the qla2xxx driver's qla_nvme_ls_unmap() function (CWE-672: Operation on a Resource After Expiration or Release). When processing NVMe LS requests, the driver called dma_unmap_page() on a DMA mapping that had already been released by the FC layer, triggering a WARNING at kernel/dma/debug.c:1017 via check_unmap(). The fix removes the redundant DMA mapping/unmapping from the driver entirely, since the FC layer already handles this lifecycle. This is a local, kernel-space issue with no network-facing attack surface (ENISA EUVD, Kernel Patch).

The practical impact of this vulnerability is limited to kernel stability on systems using the qla2xxx Fibre Channel HBA driver with NVMe over Fibre Channel (NVMe-oF) workloads. On debug kernels, the improper DMA unmap triggers a WARNING and call trace, which can disrupt diagnostics and kernel debugging workflows. There is no known confidentiality, integrity, or availability impact in production (non-debug) kernels, and no privilege escalation or remote code execution vector has been identified (ENISA EUVD).

Apply the upstream Linux kernel patches that remove the redundant DMA mapping from the qla2xxx driver. Fixed versions include Linux kernel stable releases 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3 and later. Administrators running affected kernel versions with qla2xxx HBAs in NVMe-oF configurations should update to a patched kernel release. No configuration-based workaround is available beyond disabling NVMe LS functionality, which is not practical in production environments (Kernel Patch, ENISA EUVD).