{"id":"CVE-2023-53078","title":"scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()\n\nIf alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not\nfreed, which will cause following …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 123483df146492ca22b503ae6dacc2ce7c3a3974","Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < c110051d335ef7f62ad33474b0c23997fee5bfb5","Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 5c4d71424df34fc23dc5336d09394ce68c849542","Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8","Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 9311e7a554dffd3823499e309a8b86a5cd1540e5","Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 1c55982beb80c7d3c30278fc6cfda8496a31dbe6","Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 0d89254a4320eb7de0970c478172f764125c6355","Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < a13faca032acbf2699293587085293bdfaafc8ae","Linux 68b275b7cbf065a8ea9b964cbb7d78d2b63c635f","Linux 2b1725d1df362499f6bbd5a7e245a4090b29c2bb","Linux >= 4.9.21 < 4.10","Linux >= 4.10.9 < 4.11","Linux 4.11"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:16:37.691560Z"},"published":"2025-05-02","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:20:59.303Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-53078","references":[{"url":"https://git.kernel.org/stable/c/123483df146492ca22b503ae6dacc2ce7c3a3974"},{"url":"https://git.kernel.org/stable/c/c110051d335ef7f62ad33474b0c23997fee5bfb5"},{"url":"https://git.kernel.org/stable/c/5c4d71424df34fc23dc5336d09394ce68c849542"},{"url":"https://git.kernel.org/stable/c/c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8"},{"url":"https://git.kernel.org/stable/c/9311e7a554dffd3823499e309a8b86a5cd1540e5"},{"url":"https://git.kernel.org/stable/c/1c55982beb80c7d3c30278fc6cfda8496a31dbe6"},{"url":"https://git.kernel.org/stable/c/0d89254a4320eb7de0970c478172f764125c6355"},{"url":"https://git.kernel.org/stable/c/a13faca032acbf2699293587085293bdfaafc8ae"}],"tags":["cve.org"],"epss":0.00202,"epssPercentile":0.10261,"ingestedAt":"2026-11-05T22:38:31.765Z","slug":"CVE-2023-53078","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()\n\nIf alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not\nfreed, which will cause following memleak:\n\nunreferenced object 0xffff88810b2c6980 (size 32):\n  comm \"kworker/u16:2\", pid 635322, jiffies 4355801099 (age 1216426.076s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff  @9$.............\n  backtrace:\n    [<0000000098f3a26d>] alua_activate+0xb0/0x320\n    [<000000003b529641>] scsi_dh_activate+0xb2/0x140\n    [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath]\n    [<000000007adc9ace>] process_one_work+0x3c5/0x730\n    [<00000000c457a985>] worker_thread+0x93/0x650\n    [<00000000cb80e628>] kthread+0x1ba/0x210\n    [<00000000a1e61077>] ret_from_fork+0x22/0x30\n\nFix the problem by freeing 'qdata' in error path.\n\n## Affected\n\n- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 123483df146492ca22b503ae6dacc2ce7c3a3974`\n- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < c110051d335ef7f62ad33474b0c23997fee5bfb5`\n- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 5c4d71424df34fc23dc5336d09394ce68c849542`\n- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8`\n- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 9311e7a554dffd3823499e309a8b86a5cd1540e5`\n- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 1c55982beb80c7d3c30278fc6cfda8496a31dbe6`\n- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 0d89254a4320eb7de0970c478172f764125c6355`\n- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < a13faca032acbf2699293587085293bdfaafc8ae`\n- `Linux 68b275b7cbf065a8ea9b964cbb7d78d2b63c635f`\n- `Linux 2b1725d1df362499f6bbd5a7e245a4090b29c2bb`\n- `Linux >= 4.9.21 < 4.10`\n- `Linux >= 4.10.9 < 4.11`\n- `Linux 4.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}