{"cve":"CVE-2023-54100","nvd":{"published":"2025-12-24T13:16:11.890","modified":"2026-08-04T10:19:29.303","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedi: Fix use after free bug in qedi_remove()\n\nIn qedi_probe() we call __qedi_probe() which initializes\n&qedi->recovery_work with qedi_recovery_handler() and\n&qedi->board_disable_work with qedi_board_disable_work().\n\nWhen qedi_schedule_recovery_handler() is called, schedule_delayed_work()\nwill finally start the work.\n\nIn qedi_remove(), which is called to remove the driver, the following\nsequence may be observed:\n\nFix this by finishing the work before cleanup in qedi_remove().\n\nCPU0                  CPU1\n\n                     |qedi_recovery_handler\nqedi_remove          |\n  __qedi_remove      |\niscsi_host_free      |\nscsi_host_put        |\n//free shost         |\n                     |iscsi_host_for_each_session\n                     |//use qedi->shost\n\nCancel recovery_work and board_disable_work in __qedi_remove().","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":[],"references":["https://git.kernel.org/stable/c/124027cd1a624ce0347adcd59241a9966a726b22","https://git.kernel.org/stable/c/3738a230831e861503119ee2691c4a7dc56ed60a","https://git.kernel.org/stable/c/5e756a59cee6a8a79b9059c5bdf0ecbf5bb8d151","https://git.kernel.org/stable/c/89f6023fc321c958a0fb11f143a6eb4544ae3940","https://git.kernel.org/stable/c/c5749639f2d0a1f6cbe187d05f70c2e7c544d748"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:18:08.089039631+00:00"},"epss":{"cve":"CVE-2023-54100","score":0.00161,"percentile":0.05307,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}