CVE-2023-53696
Description
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()
There is a memory leak reported by kmemleak:
unreferenced object 0xffffc900003f0000 (size 12288): comm "modprobe", pid 19117, jiffies 4299751452 (age 42490.264s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000629261a8>] __vmalloc_node_range+0xe56/0x1110 [<0000000001906886>] __vmalloc_node+0xbd/0x150 [<000000005bb4dc34>] vmalloc+0x25/0x30 [<00000000a2dc1194>] qla2x00_create_host+0x7a0/0xe30 [qla2xxx] [<0000000062b14b47>] qla2x00_probe_one+0x2eb8/0xd160 [qla2xxx] [<00000000641ccc04>] local_pci_probe+0xeb/0x1a0
The root cause is traced to an error-handling path in qla2x00_probe_one() when the adapter "base_vha" initialize failed. The fab_scan_rp "scan.l" is used to record the port information and it is allocated in qla2x00_create_host(). However, it is not released in the error handling path "probe_failed".
Fix this by freeing the memory of "scan.l" when an error occurs in the adapter initialization process.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Memory leak in qla2xxx driver's probe function when adapter initialization fails, freeing scan.l memory.
Vulnerability
In the Linux kernel's qla2xxx SCSI driver, a memory leak occurs in the qla2x00_probe_one() function during error handling. The fab_scan_rp structure (scan.l) is allocated in qla2x00_create_host() to record port information, but it is not freed if the adapter's base_vha initialization fails, leading to unreferenced memory.
Exploitation
An attacker would need to trigger a probe failure, which can happen by loading the driver with a faulty adapter or under specific error conditions. No special privileges are required; the vulnerability is triggered during driver initialization.
Impact
The memory leak causes gradual resource exhaustion, potentially leading to system instability or denial of service. Each probe failure leaks 12 KB of memory, and repeated attempts can exhaust system memory.
Mitigation
The fix is included in Linux kernel commit [1], which releases the scan.l memory in the error path. Users should apply the patch or update to a kernel version containing the fix.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
4ae73c4dd48f244374911ac63582e35e9731885ade4010e13Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4News mentions
0No linked articles in our index yet.