CVE-2023-53510

A flaw of low impact was found in the Linux kernel Universal Flash Storage (UFS) SCSI driver. When a UFS SCSI command times out, the SCSI error handler may legitimately re-submit the same command through scsi_send_eh_cmnd() before the original command has completed. The UFS driver incorrectly treated the still-populated lrbp->cmd command pointer as an invalid condition in this situation, triggering a WARN_ON in ufshcd_queuecommand(). The demonstrated consequence is a non-fatal kernel warning and stack trace during SCSI error recovery; the fixing commit does not demonstrate memory corruption, use-after-free, out-of-bounds access, information disclosure, or privilege escalation. Triggering the warning requires a UFS command timeout that causes the SCSI error-recovery path to re-enter ufshcd_queuecommand(), which is reflected in the high attack complexity of the Red Hat score. Red Hat Enterprise Linux 9 (kernel and kernel-rt) is affected and the fix is deferred: because the issue is of low severity with consequences limited to a non-fatal kernel warning in the storage error-recovery path, it will be addressed in a future RHEL 9 update rather than an immediate erratum. The residual risk is limited to that warning during UFS command timeout handling; a more severe outcome such as a kernel panic would require an additional condition such as panic_on_warn being enabled, which is not an intrinsic consequence of this flaw. Red Hat Enterprise Linux 6, 7, 8, and 10, and Red Hat In-Vehicle OS, are marked not affected because the vulnerable code is not present in those streams. The Red Hat severity of Low (CVSS 3.1 score 2.5) differs from the upstream NIST and CVE.org score of 7.8 because the upstream scoring assumes high confidentiality, integrity, and availability impacts that are not established by the available evidence for this change.