---
id: CVE-2023-53078
title: 'scsi: scsi_dh_alua: Fix memleak for ''qdata'' in alua_activate()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()

  If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not
  freed, which will cause following …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 <
    123483df146492ca22b503ae6dacc2ce7c3a3974
  - >-
    Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 <
    c110051d335ef7f62ad33474b0c23997fee5bfb5
  - >-
    Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 <
    5c4d71424df34fc23dc5336d09394ce68c849542
  - >-
    Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 <
    c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8
  - >-
    Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 <
    9311e7a554dffd3823499e309a8b86a5cd1540e5
  - >-
    Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 <
    1c55982beb80c7d3c30278fc6cfda8496a31dbe6
  - >-
    Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 <
    0d89254a4320eb7de0970c478172f764125c6355
  - >-
    Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 <
    a13faca032acbf2699293587085293bdfaafc8ae
  - Linux 68b275b7cbf065a8ea9b964cbb7d78d2b63c635f
  - Linux 2b1725d1df362499f6bbd5a7e245a4090b29c2bb
  - Linux >= 4.9.21 < 4.10
  - Linux >= 4.10.9 < 4.11
  - Linux 4.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:16:37.691560Z'
published: '2025-05-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:20:59.303Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53078'
references:
  - url: 'https://git.kernel.org/stable/c/123483df146492ca22b503ae6dacc2ce7c3a3974'
  - url: 'https://git.kernel.org/stable/c/c110051d335ef7f62ad33474b0c23997fee5bfb5'
  - url: 'https://git.kernel.org/stable/c/5c4d71424df34fc23dc5336d09394ce68c849542'
  - url: 'https://git.kernel.org/stable/c/c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8'
  - url: 'https://git.kernel.org/stable/c/9311e7a554dffd3823499e309a8b86a5cd1540e5'
  - url: 'https://git.kernel.org/stable/c/1c55982beb80c7d3c30278fc6cfda8496a31dbe6'
  - url: 'https://git.kernel.org/stable/c/0d89254a4320eb7de0970c478172f764125c6355'
  - url: 'https://git.kernel.org/stable/c/a13faca032acbf2699293587085293bdfaafc8ae'
tags:
  - cve.org
epss: 0.00202
epssPercentile: 0.10261
ingestedAt: '2026-11-05T22:38:31.765Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()

If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not
freed, which will cause following memleak:

unreferenced object 0xffff88810b2c6980 (size 32):
  comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff  @9$.............
  backtrace:
    [<0000000098f3a26d>] alua_activate+0xb0/0x320
    [<000000003b529641>] scsi_dh_activate+0xb2/0x140
    [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath]
    [<000000007adc9ace>] process_one_work+0x3c5/0x730
    [<00000000c457a985>] worker_thread+0x93/0x650
    [<00000000cb80e628>] kthread+0x1ba/0x210
    [<00000000a1e61077>] ret_from_fork+0x22/0x30

Fix the problem by freeing 'qdata' in error path.

## Affected

- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 123483df146492ca22b503ae6dacc2ce7c3a3974`
- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < c110051d335ef7f62ad33474b0c23997fee5bfb5`
- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 5c4d71424df34fc23dc5336d09394ce68c849542`
- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8`
- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 9311e7a554dffd3823499e309a8b86a5cd1540e5`
- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 1c55982beb80c7d3c30278fc6cfda8496a31dbe6`
- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 0d89254a4320eb7de0970c478172f764125c6355`
- `Linux >= 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < a13faca032acbf2699293587085293bdfaafc8ae`
- `Linux 68b275b7cbf065a8ea9b964cbb7d78d2b63c635f`
- `Linux 2b1725d1df362499f6bbd5a7e245a4090b29c2bb`
- `Linux >= 4.9.21 < 4.10`
- `Linux >= 4.10.9 < 4.11`
- `Linux 4.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.