CVE-2023-54289: scsi: qedf: Fix NULL dereference in error handling

Deferred
AliasesUBUNTU-CVE-2023-54289DEBIAN-CVE-2023-54289
Published 30-12-2025Last modified 11-05-2026

Vulnerability summary

CVE-2023-54289 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.5% of scored vulnerabilities.

Priority
Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.21%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 13
RHSA-2024:2394RHSA-2024:3138SUSE-SU-2026:0263-1SUSE-SU-2026:0278-1SUSE-SU-2026:0281-1SUSE-SU-2026:0293-1

Timeline

  1. 30-12-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix NULL dereference in error handling Smatch reported: drivers/scsi/qedf/qedf_main.c:3056 qedf_alloc_global_queues() warn: missing unwind goto? At this point in the function, nothing has been allocated so we can return directly. In particular the "qedf->global_queues" have not been allocated so calling qedf_free_global_queues() will lead to a NULL dereference when we check if (!gl[i]) and "gl" is NULL.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.21% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: not stated in public data.

Ubuntu123 products
  • linuxAll versions (No fix recorded) | < 5.4.0-166.183 | < 5.15.0-86.96
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.4.0-1113.123 | < 5.15.0-1047.52
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.52-1 | < 6.4.4-1
Linux1 product
  • linux≥ 61d8658b4a435eac729966cc94cdda077a8df5cd, < 961c8370c5f7e80a267680476e1bcff34bffe71a | ≥ 61d8658b4a435eac729966cc94cdda077a8df5cd, < ac64019e4d4b08c23edb117e0b2590985e33de1d | ≥ 61d8658b4a435eac729966cc94cdda077a8df5cd, < b1de5105d29b145b727b797e2d5de071ab3a7ca1 | ≥ 61d8658b4a435eac729966cc94cdda077a8df5cd, < c316bde418af4c2a9df51149ed01d1bd8ca5bebf | ≥ 61d8658b4a435eac729966cc94cdda077a8df5cd, < 08c001c1e9444a3046c79a99aa93ac48073b18cc | ≥ 61d8658b4a435eac729966cc94cdda077a8df5cd, < 271c9b2eb60149afbeab28cb39e52f73bde9900c | ≥ 61d8658b4a435eac729966cc94cdda077a8df5cd, < f025312b089474a54e4859f3453771314d9e3d4f | 4.11

3 vendors · 125 products

References

11 links
Show all 11 references