{"cve":"CVE-2023-53245","nvd":{"published":"2025-09-15T15:15:51.683","modified":"2026-06-17T06:44:37.140","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: storvsc: Fix handling of virtual Fibre Channel timeouts\n\nHyper-V provides the ability to connect Fibre Channel LUNs to the host\nsystem and present them in a guest VM as a SCSI device. I/O to the vFC\ndevice is handled by the storvsc driver. The storvsc driver includes a\npartial integration with the FC transport implemented in the generic\nportion of the Linux SCSI subsystem so that FC attributes can be displayed\nin /sys.  However, the partial integration means that some aspects of vFC\ndon't work properly. Unfortunately, a full and correct integration isn't\npractical because of limitations in what Hyper-V provides to the guest.\n\nIn particular, in the context of Hyper-V storvsc, the FC transport timeout\nfunction fc_eh_timed_out() causes a kernel panic because it can't find the\nrport and dereferences a NULL pointer. The original patch that added the\ncall from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this\nregard.\n\nIn many cases a timeout is due to a transient condition, so the situation\ncan be improved by just continuing to wait like with other I/O requests\nissued by storvsc, and avoiding the guaranteed panic. For a permanent\nfailure, continuing to wait may result in a hung thread instead of a panic,\nwhich again may be better.\n\nSo fix the panic by removing the storvsc call to fc_eh_timed_out().  This\nallows storvsc to keep waiting for a response.  The change has been tested\nby users who experienced a panic in fc_eh_timed_out() due to transient\ntimeouts, and it solves their problem.\n\nIn the future we may want to deprecate the vFC functionality in storvsc\nsince it can't be fully fixed. But it has current users for whom it is\nworking well enough, so it should probably stay for a while longer.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-476"],"references":["https://git.kernel.org/stable/c/048ebc9a28fb918ee635dd4b2fcf4248eb6e4050","https://git.kernel.org/stable/c/1678408d08f31a694d5150a56796dd04c9710b22","https://git.kernel.org/stable/c/175544ad48cbf56affeef2a679c6a4d4fb1e2881","https://git.kernel.org/stable/c/311db605e07f0d4fc0cc7ddb74f1e5692ea2f469","https://git.kernel.org/stable/c/763c06565055ae373fe7f89c11e1447bd1ded264"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:08:41.295252406+00:00"},"epss":{"cve":"CVE-2023-53245","score":0.00149,"percentile":0.04054,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}