CVE-2023-54289: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54289 is a NULL pointer dereference vulnerability in the Linux kernel's SCSI qedf (QLogic FCoE) driver, specifically in the qedf_alloc_global_queues() function in drivers/scsi/qedf/qedf_main.c. The flaw was identified by the Smatch static analysis tool and disclosed on December 30, 2025. It affects Linux kernel versions from 4.11 up to the patched stable releases (5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, and 6.5). The CVSS score is not officially published, but Feedly estimates the severity as Medium (Feedly, ENISA EUVD).

The root cause is a NULL pointer dereference (CWE-476) in the error handling path of qedf_alloc_global_queues(). When an early allocation failure occurs, the function incorrectly calls qedf_free_global_queues() before qedf->global_queues has been allocated. This causes a NULL dereference when the cleanup function attempts to iterate over the gl (global queues) array and checks if (!gl[i]) while gl itself is NULL. The fix changes the error path to return directly rather than jumping to the unwind/cleanup label, avoiding the premature call to the free function (Feedly, Kernel Git).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, which typically results in a kernel panic (system crash) and denial of service on the affected host. The impact is limited to availability — confidentiality and integrity are not directly affected. The vulnerability is confined to systems using the qedf (QLogic FCoE) SCSI driver, limiting the affected asset scope to servers with QLogic Fibre Channel over Ethernet hardware (Feedly).

Apply the upstream Linux kernel patches that fix this issue. The corrected versions are: 5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, and 6.5 (and later). Patches are available via the stable kernel git repository at multiple commit references. As a workaround, systems that do not use QLogic FCoE hardware can blacklist or unload the qedf kernel module to eliminate exposure (Kernel Git, ENISA EUVD).