CVE-2023-52811
scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool In practice the driver should never send more commands than are allocated to a queue's event pool. In the unlikely event that this happens, the code asserts a BUG_ON, and in the case that the kernel is not configured to crash on panic returns a junk event pointer from the empty event list causing things to spiral from there. This BUG_ON is a historical artifact of the ibmvfc driver first being upstreamed, and it is well known now that the use of BUG_ON is bad practice except in the most unrecoverable scenario. There is nothing about this scenario that prevents the driver from recovering and carrying on. Remove the BUG_ON in question from ibmvfc_get_event() and return a NULL pointer in the case of an empty event pool. Update all call sites to ibmvfc_get_event() to check for a NULL pointer and perfrom the appropriate failure or recovery action.
Timeline
ID reserved
By Linux
Published
- 24 months later
· 24 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.25% · top 84% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Weakness
- CWE-noinfo Not enough information
- CWE-476 (opens in a new tab)All about CWE-476 and its CVEs
Affected products
- affected 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 – < e1d1f79b1929dce470a5dc9281c574cd58e8c6c0
- affected 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 – < 88984ec4792766df5a9de7a2ff2b5f281f94c7d4
- affected 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 – < d2af4ef80601224b90630c1ddc7cd2c7c8ab4dd8
- affected 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 – < 8bbe784c2ff28d56ca0c548aaf3e584edc77052d
- affected 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 – < b39f2d10b86d0af353ea339e5815820026bca48f
- affected 2.6.27
- unaffected < 2.6.27
- unaffected 5.15.140 – ≤ 5.15.*
- unaffected 6.1.64 – ≤ 6.1.*
- unaffected 6.5.13 – ≤ 6.5.*
- unaffected 6.6.3 – ≤ 6.6.*
- unaffected 6.7 – ≤ *
References (5)
- https://git.kernel.org/stable/c/e1d1f79b1929dce470a5dc9281c574cd58e8c6c0 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/88984ec4792766df5a9de7a2ff2b5f281f94c7d4 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/d2af4ef80601224b90630c1ddc7cd2c7c8ab4dd8 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/8bbe784c2ff28d56ca0c548aaf3e584edc77052d (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/b39f2d10b86d0af353ea339e5815820026bca48f (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-52811)Record last updated .