CVE-2023-54234: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54234 is a use-after-free vulnerability in the Linux kernel's scsi: mpi3mr driver, caused by missing initialization of the mrioc->evtack_cmds array. The flaw was introduced by commit c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") and results in a KASAN-detected "BUG: KASAN: use-after-free" when the mpi3mr_complete_evt_ack() function accesses an uninitialized host_tag field. The vulnerability affects Linux kernel versions starting from the introduction of the faulty commit up through the patched releases (fixed in stable branches at commits 4e0dfdb48a82, 67989091e11a, and e39ea831ebad). It was published on December 30, 2025, with an EPSS score of approximately 0.022% (Feedly, EUVD).

The root cause is a missing initialization of array elements in mrioc->evtack_cmds, which are only zero-cleared rather than properly initialized (CWE-908: Use of Uninitialized Resource, leading to CWE-416: Use After Free). When mpi3mr_complete_evt_ack() reads the host_tag field — which is zero due to the missing initialization — it calls clear_bit() on mrioc->evtack_cmds_bitmap with an incorrect bit index, resulting in a memory access to an invalid address. The bug was observed during an eHBA-9600 firmware update to version 8.3.1.0. The fix adds the missing initialization of mrioc->evtack_cmds array elements (Feedly, Kernel Patch 1).

Exploitation of this vulnerability can cause a kernel panic or system crash (denial of service) due to invalid memory access triggered in the SCSI mpi3mr driver. The use-after-free condition may also theoretically allow local privilege escalation or kernel memory corruption, though the primary observed impact is system instability during specific hardware events such as firmware updates on affected HBA controllers. Systems using Broadcom/LSI eHBA-9600 or similar hardware managed by the mpi3mr driver are at risk (Feedly).

Apply the upstream Linux kernel patches that add the missing initialization of mrioc->evtack_cmds. The fixes are available in the following stable kernel commits: 4e0dfdb48a824deac3dfbc67fb856ef2aee13529, 67989091e11a974003ddf2ec39bc613df8eadd83, and e39ea831ebad4ab15c4748cb62a397a8abcca36e, corresponding to patched versions 6.1.16, 6.2.3, and 6.3 respectively. Users should update to a patched kernel version; as a temporary workaround, avoiding firmware updates on eHBA-9600 controllers until the patch is applied may reduce exposure (Feedly, Kernel Patch 1).