{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2023-54184",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-12-30T12:06:44.497Z",
        "datePublished": "2025-12-30T12:08:54.528Z",
        "dateUpdated": "2026-05-11T19:57:05.371Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-05-11T19:57:05.371Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsit: Free cmds before session free\n\nCommands from recovery entries are freed after session has been closed.\nThat leads to use-after-free at command free or NPE with such call trace:\n\nTime2Retain timer expired for SID: 1, cleaning up iSCSI session.\nBUG: kernel NULL pointer dereference, address: 0000000000000140\nRIP: 0010:sbitmap_queue_clear+0x3a/0xa0\nCall Trace:\n target_release_cmd_kref+0xd1/0x1f0 [target_core_mod]\n transport_generic_free_cmd+0xd1/0x180 [target_core_mod]\n iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod]\n iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod]\n iscsit_close_session+0x13a/0x140 [iscsi_target_mod]\n iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod]\n call_timer_fn+0x24/0x140\n\nMove cleanup of recovery enrties to before session freeing."
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/target/iscsi/iscsi_target.c"
                    ],
                    "versions": [
                        {
                            "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                            "lessThan": "89f5055f9b0b57c7e7f02e32df95ef401f809b71",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                            "lessThan": "4621e24c9257c6379343bf0c11b473817cf7edcd",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                            "lessThan": "1911cca5916b6e106de7afa3ec0a38447158216c",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                            "lessThan": "a7a4def6c7046e090bb10c6d550fdeb487db98ba",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                            "lessThan": "4ce221d295f53e6c6b835ab33181e735482c9aac",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "988e3a85463d9b6dabc681df3f8f131b23c19953",
                            "lessThan": "d8990b5a4d065f38f35d69bcd627ec5a7f8330ca",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/target/iscsi/iscsi_target.c"
                    ],
                    "versions": [
                        {
                            "version": "3.12",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "3.12",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.4.244",
                            "lessThanOrEqual": "5.4.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.10.181",
                            "lessThanOrEqual": "5.10.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.113",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.30",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.3.4",
                            "lessThanOrEqual": "6.3.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.4",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.12",
                                    "versionEndExcluding": "5.4.244"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.12",
                                    "versionEndExcluding": "5.10.181"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.12",
                                    "versionEndExcluding": "5.15.113"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.12",
                                    "versionEndExcluding": "6.1.30"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.12",
                                    "versionEndExcluding": "6.3.4"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "3.12",
                                    "versionEndExcluding": "6.4"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/89f5055f9b0b57c7e7f02e32df95ef401f809b71"
                },
                {
                    "url": "https://git.kernel.org/stable/c/4621e24c9257c6379343bf0c11b473817cf7edcd"
                },
                {
                    "url": "https://git.kernel.org/stable/c/1911cca5916b6e106de7afa3ec0a38447158216c"
                },
                {
                    "url": "https://git.kernel.org/stable/c/a7a4def6c7046e090bb10c6d550fdeb487db98ba"
                },
                {
                    "url": "https://git.kernel.org/stable/c/4ce221d295f53e6c6b835ab33181e735482c9aac"
                },
                {
                    "url": "https://git.kernel.org/stable/c/d8990b5a4d065f38f35d69bcd627ec5a7f8330ca"
                }
            ],
            "title": "scsi: target: iscsit: Free cmds before session free",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}