In the Linux kernel, the following vulnerability has been resolved:

scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition

mptlan_probe() calls mpt_register_lan_device() which initializes the
&priv->post_buckets_task workqueue. A call to
mpt_lan_wake_post_buckets_task() will subsequently start the work.

During driver unload in mptlan_remove() the following race may occur:

CPU0 CPU1

|mpt_lan_post_receive_buckets_work()
mptlan_remove() |
free_netdev() |
kfree(dev); |
|
| dev->mtu
| //use

Fix this by finishing the work prior to cleaning up in mptlan_remove().

[mkp: we really should remove mptlan instead of attempting to fix it]

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00036.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected
< 92f869693d84e813895ff4d25363744575515423
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected
< 60c8645ad6f5b722615383d595d63b62b07a13c3
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected
< 410e610a96c52a7b41e2ab6c9ca60868d9acecce
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected
< 697f92f8317e538d8409a0c95d6370eb40b34c05
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected
< e84282efc87f2414839f6e15c31b4daa34ebaac1
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected
< 9c6da3b7f12528cd52c458b33496a098b838fcfc
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected
< 48daa4a3015d859ee424948844ce3c12f2fe44e6
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected
< f486893288f3e9b171b836f43853a6426515d800
Linux Linux affected
Version Status Constraints
2.6.12 affected
—
0 unaffected
< 2.6.12
4.14.316 unaffected
≤ 4.14.*
4.19.284 unaffected
≤ 4.19.*
5.4.244 unaffected
≤ 5.4.*
5.10.181 unaffected
≤ 5.10.*
5.15.113 unaffected
≤ 5.15.*
6.1.30 unaffected
≤ 6.1.*
6.3.4 unaffected
≤ 6.3.*
6.4 unaffected
≤ *

No data.

No data.

No data.

Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/410e610a96c52a7b41e2ab6c9ca60868d9acecce cve-icon cve-icon
https://git.kernel.org/stable/c/48daa4a3015d859ee424948844ce3c12f2fe44e6 cve-icon cve-icon
https://git.kernel.org/stable/c/60c8645ad6f5b722615383d595d63b62b07a13c3 cve-icon cve-icon
https://git.kernel.org/stable/c/697f92f8317e538d8409a0c95d6370eb40b34c05 cve-icon cve-icon
https://git.kernel.org/stable/c/92f869693d84e813895ff4d25363744575515423 cve-icon cve-icon
https://git.kernel.org/stable/c/9c6da3b7f12528cd52c458b33496a098b838fcfc cve-icon cve-icon
https://git.kernel.org/stable/c/e84282efc87f2414839f6e15c31b4daa34ebaac1 cve-icon cve-icon
https://git.kernel.org/stable/c/f486893288f3e9b171b836f43853a6426515d800 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025123035-CVE-2023-54310-cc98@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-54310 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-54310 cve-icon
History

Wed, 31 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Tue, 30 Dec 2025 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition mptlan_probe() calls mpt_register_lan_device() which initializes the &priv->post_buckets_task workqueue. A call to mpt_lan_wake_post_buckets_task() will subsequently start the work. During driver unload in mptlan_remove() the following race may occur: CPU0 CPU1 |mpt_lan_post_receive_buckets_work() mptlan_remove() | free_netdev() | kfree(dev); | | | dev->mtu | //use Fix this by finishing the work prior to cleaning up in mptlan_remove(). [mkp: we really should remove mptlan instead of attempting to fix it]
Title scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-01-05T11:37:21.085Z

Reserved: 2025-12-30T12:06:44.530Z

Link: CVE-2023-54310

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-30T13:16:20.200

Modified: 2025-12-31T20:42:43.210

Link: CVE-2023-54310

cve-icon Redhat

Severity : Low

Publid Date: 2025-12-30T00:00:00Z

Links: CVE-2023-54310 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.